Attack Chain

1. Attacker performs reconnaissance to identify exposed instances of FooSun DotNetCMS.
2. Attacker crafts an HTTP GET request targeting the /user/City_ajax.aspx endpoint.
3. Attacker injects a malicious payload into the CityId parameter (e.g., using UNION SELECT syntax).
4. The DotNetCMS application receives the request and fails to sanitize the CityId input.
5. The application concatenates the malicious input directly into an MSSQL query for the sys_City database operation.
6. The back-end database executes the injected query, returning sensitive database content to the application.
7. The application returns the exfiltrated database results within the HTTP response to the attacker.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to perform arbitrary SQL queries against the underlying database. This leads to the potential exfiltration of sensitive information, including user credentials, configuration data, or other proprietary content stored within the DotNetCMS database, posing a high risk to data confidentiality.

Recommendation

• Deploy the provided Sigma rule to your web application firewall or SIEM to detect exploitation attempts targeting /user/City_ajax.aspx.
• Audit logs for suspicious GET requests to /user/City_ajax.aspx containing SQL injection syntax, particularly UNION and SELECT keywords in the CityId parameter.
• Review database access logs and application error logs for signs of unauthorized data retrieval or unexpected SQL syntax errors.
• If possible, upgrade to a non-vulnerable version of the CMS or apply a vendor-provided patch to remediate CVE-2015-20128.