FooSun DotNetCMS: SQL injection via CityId parameter in City_ajax.aspx

Summary

FooSun DotNetCMS versions 1.0 and 2.0 contain an SQL injection flaw in the CityId parameter of /user/City_ajax.aspx. An unauthenticated remote attacker can send crafted GET requests with UNION SELECT payloads to extract data from the MSSQL database behind the site. Public proof-of-concept material and a detection template exist, and the CVE record reports exploitation evidence, so the risk is real for any internet-facing installation.

Affected

• FooSun DotNetCMS 1.0
• FooSun DotNetCMS 2.0
• Vulnerable component: /user/City_ajax.aspx (CityId parameter)

Fixed in

Unknown. No vendor advisory or patch was found. A third-party source states that the affected products are no longer supported by the maintainer.

Workaround

• Block or restrict access to /user/City_ajax.aspx at the web application firewall or reverse proxy
• Deploy WAF rules for SQL injection detection on this endpoint
• Remove or disable the City_ajax.aspx page if the site does not need it
• Limit the database account used by the CMS to the rights it requires

Exploitation

• Exploitation evidence: the CVE record states that the Shadowserver Foundation first observed exploitation on 2023-10-14. Other sources give a different date (10/14/2026), so the timeline is unclear.
• Public proof of concept: a technical write-up and a nuclei detection template exist.
• CISA SSVC assessment: exploitation status poc, automatable yes, technical impact partial.
• KEV status is conflicting: one source lists a VulnCheck KEV entry, while others do not mark it as known exploited. CISA KEV status was not confirmed.
• EPSS is about 0.003 (low predicted activity).

Our recommendation

• Check whether any DotNetCMS installation exists, including old or forgotten sites.
• If found, check whether the site is reachable from the internet and restrict it.
• Block or restrict /user/City_ajax.aspx at the WAF or reverse proxy.
• Review web and database logs for requests to that path with UNION-based query strings and treat any hit as a possible compromise.
• Plan a migration to a supported CMS, since no vendor fix is expected.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• NVD/CVE record source: VulnCheck advisory www.vulncheck.com
• nuclei-templates detection template github.com
• cnblogs technical article www.cnblogs.com
• VulDB entry vuldb.com
• OpenCVE CVE page app.opencve.io
• Hol.org CVE record hol.org
• Exploit-Intel CVE page exploit-intel.com
• Archived vendor website (FooSun) web.archive.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:32.