CVE-2015-20128 FooSun CVE debrief

Who should care

Defenders and administrators of DotNetCMS 1.0 and 2.0 deployments should assess exposure and prioritize patching or mitigation. They should verify exposure of DotNetCMS 1.0 and 2.0 deployments, especially those with publicly accessible City_ajax.aspx, and apply patches or mitigations. Security teams and vulnerability management teams should also prioritize verifying exposure and applying patches or mitigations.

Why it matters

CVE-2015-20128 is a significant SQL injection vulnerability in FooSun DotNetCMS 1.0 and 2.0. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent potential exploitation.

• Verify exposure of DotNetCMS 1.0 and 2.0 deployments
• Check for publicly accessible City_ajax.aspx
• Prioritize patching or mitigation
• Monitor for suspicious activity

Technical summary

The SQL injection vulnerability in FooSun DotNetCMS 1.0 and 2.0 allows attackers to manipulate MSSQL queries through the CityId parameter in City_ajax.aspx. This can be exploited by sending GET requests with UNION SELECT payloads in CityId. The vulnerability allows unauthenticated attackers to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14. Defenders should prioritize verifying exposure of DotNetCMS 1.0 and 2.0 deployments, especially those with publicly accessible City_ajax.aspx, and apply patches or mitigations.

Defensive priority

Defenders should prioritize verifying exposure of DotNetCMS 1.0 and 2.0 deployments, especially those with publicly accessible City_ajax.aspx, and apply patches or mitigations.

Recommended defensive actions

• Verify exposure of DotNetCMS 1.0 and 2.0 deployments
• Check for publicly accessible City_ajax.aspx
• Apply patches or mitigations
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the SQL injection vulnerability. However, the corpus lacks information on actual exploitation, victims, or business impact. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14. The vulnerability allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter in City_ajax.aspx. This can be exploited by sending GET requests with UNION SELECT payloads in CityId. Defenders should verify exposure and apply patches or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.