{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/dotnetcms/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:foosun:dotnetcms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2015-20128"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DotNetCMS (1.0, 2.0)"],"_cs_severities":["high"],"_cs_tags":["sqli","web-vulnerability","dotnetcms"],"_cs_type":"threat","_cs_vendors":["FooSun"],"content_html":"\u003cp\u003eFooSun DotNetCMS versions 1.0 and 2.0 are susceptible to an unauthenticated SQL injection vulnerability identified as CVE-2015-20128. The flaw exists within the processing of the CityId parameter on the /user/City_ajax.aspx endpoint. Attackers can inject malicious SQL commands, specifically using UNION SELECT payloads, which are concatenated into the back-end MSSQL query without proper sanitization. This vulnerability allows remote, unauthenticated actors to extract sensitive data from the underlying database. The vulnerability has been documented as being actively exploited in the wild since October 2023. Given the lack of input validation, defenders should monitor for anomalous HTTP requests targeting this specific endpoint.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify exposed instances of FooSun DotNetCMS.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP GET request targeting the /user/City_ajax.aspx endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker injects a malicious payload into the CityId parameter (e.g., using UNION SELECT syntax).\u003c/li\u003e\n\u003cli\u003eThe DotNetCMS application receives the request and fails to sanitize the CityId input.\u003c/li\u003e\n\u003cli\u003eThe application concatenates the malicious input directly into an MSSQL query for the sys_City database operation.\u003c/li\u003e\n\u003cli\u003eThe back-end database executes the injected query, returning sensitive database content to the application.\u003c/li\u003e\n\u003cli\u003eThe application returns the exfiltrated database results within the HTTP response to the attacker.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthenticated attackers to perform arbitrary SQL queries against the underlying database. This leads to the potential exfiltration of sensitive information, including user credentials, configuration data, or other proprietary content stored within the DotNetCMS database, posing a high risk to data confidentiality.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your web application firewall or SIEM to detect exploitation attempts targeting /user/City_ajax.aspx.\u003c/li\u003e\n\u003cli\u003eAudit logs for suspicious GET requests to /user/City_ajax.aspx containing SQL injection syntax, particularly UNION and SELECT keywords in the CityId parameter.\u003c/li\u003e\n\u003cli\u003eReview database access logs and application error logs for signs of unauthorized data retrieval or unexpected SQL syntax errors.\u003c/li\u003e\n\u003cli\u003eIf possible, upgrade to a non-vulnerable version of the CMS or apply a vendor-provided patch to remediate CVE-2015-20128.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T21:53:35Z","date_published":"2026-10-20T21:53:35Z","id":"https://feed.craftedsignal.io/briefs/2026-10-foosun-dotnetcms-sqli/","summary":"FooSun DotNetCMS versions 1.0 and 2.0 contain an unauthenticated SQL injection vulnerability in the CityId parameter of the /user/City_ajax.aspx endpoint, which is being actively exploited to extract database information.","title":"FooSun DotNetCMS SQL Injection (CVE-2015-20128)","url":"https://feed.craftedsignal.io/briefs/2026-10-foosun-dotnetcms-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Dotnetcms","version":"https://jsonfeed.org/version/1.1"}