Shadowserver Sees Unauthenticated SQL Injection Attacks Against FooSun DotNetCMS

The Shadowserver Foundation reported observing exploitation evidence for CVE-2015-20128 on October 14, 2023. This finding highlights ongoing risk for environments running older versions of FooSun DotNetCMS that remain exposed to the internet.

What happened

The vulnerability exists in FooSun DotNetCMS versions 1.0 and 2.0. According to the NVD record, the flaw is an SQL injection issue classified under CWE-89. It allows unauthenticated attackers to manipulate Microsoft SQL Server queries. The attack vector involves sending GET requests to the /user/City_ajax.aspx endpoint. Attackers place UNION SELECT payloads within the CityId parameter.

The application concatenates this unsanitized input directly into the sys_City query. This behavior allows attackers to extract database information. The National Vulnerability Database assigns a CVSS score of 8.8, rating the severity as HIGH. The record notes that the weakness stems from the direct concatenation of unsanitized data into the query string.

Why it matters

The observation by the Shadowserver Foundation indicates that this specific vulnerability is being actively probed or exploited in the wild. Security operations teams must recognize that legacy software remains a target. The unauthenticated nature of the attack lowers the barrier for entry. Attackers do not need valid credentials to initiate the request.

Environments running FooSun DotNetCMS 1.0 or 2.0 are exposed. The use of Microsoft SQL Server as the backend is a specific detail provided in the advisory. While the source does not state that MSSQL increases the risk profile, it identifies it as the target database. Teams should verify their inventory for these specific product versions.

Our take on the response

• Verify if any systems in the environment are running FooSun DotNetCMS version 1.0 or 2.0.
• Check web server logs for GET requests to /user/City_ajax.aspx containing suspicious CityId parameters.
• Monitor for outbound database queries that include UNION SELECT statements, which indicate attempted extraction.
• Restrict access to the affected endpoint if immediate remediation is not possible, using network-level controls.

What defenders should look for

Teams usually start by reviewing web access logs for unusual GET requests to the City_ajax.aspx path. Look for parameters that contain SQL keywords like UNION, SELECT, or single quotes. Alerting on high-volume requests to this endpoint from single sources can help identify scanning activity. Check whether database audit logs show unexpected query patterns or large data retrievals. Containment moves often involve blocking the source IP addresses at the firewall level while investigating the extent of any potential data exfiltration. Ensure that monitoring covers both the web server layer and the database layer to catch the full attack chain.

Background: Data exfiltration

Data exfiltration is the unauthorized transfer of information from a computer or network to an external recipient. It occurs when attackers move sensitive files, credentials, or databases out of your control. Understanding the methods helps you spot the subtle signs of data leaving your environment without triggering standard alarms.

Read the full guide: Data Exfiltration Explained: How Data Leaves Your Network

What to do and how to stay safe: FooSun DotNetCMS

• Conduct an immediate inventory check for FooSun DotNetCMS versions 1.0 and 2.0 across all public-facing and internal networks.
• Review web server logs for the /user/City_ajax.aspx endpoint to identify any historical requests containing SQL injection payloads.
• Implement network-level restrictions to block unauthorized access to the affected application until a vendor update is provided.
• Monitor database activity for anomalous UNION SELECT queries that may indicate ongoing exploitation attempts.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What versions of FooSun DotNetCMS are affected by CVE-2015-20128?

FooSun DotNetCMS versions 1.0 and 2.0 are affected by this SQL injection vulnerability.

How did attackers exploit this vulnerability?

Attackers sent GET requests with UNION SELECT payloads in the CityId parameter to the /user/City_ajax.aspx endpoint.

When was exploitation of this flaw first observed?

The Shadowserver Foundation first observed exploitation evidence on October 14, 2023.