CVE-2011-1571
Liferay Portal 5.1.0-5.1.1 and 5.0.0-6.0.5 - Remote Code Execution in XSL Content Portlet
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2011-1571. PoCs published by Spencer McIntyre, noobpk.
AI-analyzed exploit summary This Metasploit module exploits a vulnerability in Liferay's XSL parser to achieve remote command execution via Java calls in the Xalan XSLT processor. It requires authentication and can automatically select targets based on version detection.
Description
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
Exploits (2)
This Metasploit module exploits a vulnerability in Liferay's XSL parser to achieve remote command execution via Java calls in the Xalan XSLT processor. It requires authentication and can automatically select targets based on version detection.
This is a functional Metasploit module that exploits a vulnerability in Liferay's XSL parser to achieve remote code execution via crafted XSLT data. It includes authentication, session handling, and payload delivery mechanisms.