CVE-2020-7934

This is a proof-of-concept for a stored XSS vulnerability in LifeRay 7.2.1 GA2. It demonstrates credential phishing by prompting the user for email and password, then sending the captured data to an attacker-controlled server.

This repository contains a functional proof-of-concept for CVE-2020-7934, an authenticated stored XSS vulnerability in Liferay Portal 7.2.1 GA2. The exploit demonstrates how malicious JavaScript can be injected into user profile fields and executed when another user searches for the infected profile.

This repository contains a functional proof-of-concept for CVE-2020-7934, a stored XSS vulnerability in Liferay Portal 7.2.1 GA2. The exploit demonstrates credential phishing by injecting malicious JavaScript into a user's profile field, which executes when an admin views the user's details.