DotNetCMS (1.0, 2.0)

FooSun DotNetCMS versions 1.0 and 2.0 contain an unauthenticated SQL injection vulnerability in the CityId parameter of the /user/City_ajax.aspx endpoint, which is being actively exploited to extract database information.