CVE-2015-20128

HIGH 8.2

FooSun DotNetCMS 1.0 / 2.0 SQL Injection via City_ajax.aspx

CVSS Score

8.2

EPSS Score

0.0%

EPSS Percentile

0th

FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

CWE	CWE-89
Vendor	foosun
Product	dotnetcms
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for foosun dotnetcms

Be the first to know when new high vulnerabilities affecting foosun dotnetcms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

FooSun / DotNetCMS

1.0 2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cnblogs.com: https://www.cnblogs.com/rebeyond/p/4951418.html github.com: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/dotnetcms-sqli.yaml web.archive.org: https://web.archive.org/web/20150203014116/http://www.foosun.net/ vulncheck.com: https://www.vulncheck.com/advisories/foosun-dotnetcms-1.0-2.0-sql-injection-via-city-ajax-aspx

Credits

🔍 The Shadowserver Foundation