CVE-2025-28367

mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.
References
Link Resource
https://github.com/i7MEDIA/mojoportal Product
https://www.0xlanks.me/blog/cve-2025-28367-advisory/ Exploit Third Party Advisory Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:mojoportal:mojoportal:*:*:*:*:*:*:*:*

History

23 Jun 2025, 13:14

Type Values Removed Values Added
First Time Mojoportal mojoportal
Mojoportal
CPE cpe:2.3:a:mojoportal:mojoportal:*:*:*:*:*:*:*:*
References () https://github.com/i7MEDIA/mojoportal - () https://github.com/i7MEDIA/mojoportal - Product
References () https://www.0xlanks.me/blog/cve-2025-28367-advisory/ - () https://www.0xlanks.me/blog/cve-2025-28367-advisory/ - Exploit, Third Party Advisory, Patch

23 Apr 2025, 14:08

Type Values Removed Values Added
Summary
  • (es) mojoPortal &lt;=2.9.0.1 es vulnerable a Directory Traversal mediante la acción ImageHandler del controlador de la API BetterImageGallery. Un atacante puede explotar esta vulnerabilidad para acceder al archivo Web.Config y obtener la MachineKey.

21 Apr 2025, 16:15

Type Values Removed Values Added
New CVE

Information

Published : 2025-04-21 16:15

Updated : 2025-06-23 13:14


NVD link : CVE-2025-28367

Mitre link : CVE-2025-28367

CVE.ORG link : CVE-2025-28367


JSON object : View

Products Affected

mojoportal

  • mojoportal
CWE
CWE-284

Improper Access Control