mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.
References
Link | Resource |
---|---|
https://github.com/i7MEDIA/mojoportal | Product |
https://www.0xlanks.me/blog/cve-2025-28367-advisory/ | Exploit Third Party Advisory Patch |
Configurations
History
23 Jun 2025, 13:14
Type | Values Removed | Values Added |
---|---|---|
First Time |
Mojoportal mojoportal
Mojoportal |
|
CPE | cpe:2.3:a:mojoportal:mojoportal:*:*:*:*:*:*:*:* | |
References | () https://github.com/i7MEDIA/mojoportal - Product | |
References | () https://www.0xlanks.me/blog/cve-2025-28367-advisory/ - Exploit, Third Party Advisory, Patch |
23 Apr 2025, 14:08
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
21 Apr 2025, 16:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2025-04-21 16:15
Updated : 2025-06-23 13:14
NVD link : CVE-2025-28367
Mitre link : CVE-2025-28367
CVE.ORG link : CVE-2025-28367
JSON object : View
Products Affected
mojoportal
- mojoportal
CWE
CWE-284
Improper Access Control