Liferay does not restrict a URL that has a 'sleepy user agent' query appended to it like: https://domain/page?1%2b(select*from(select(sleep(x)))a)%2b=1
Environment
Liferay DXP 7.4
Resolution
Sleepy user agent payload gets a page in sleep mode(inactive) for x seconds of time, which is not the observed behavior on the Liferay portal.
There would be the addition of an SQL query in the User-agent header of the page, which is also False in this case.
Hence, this vulnerability is not present on Liferay.
Additional Information
In order to check the User-agent header, the user can perform a network analysis of all the requests/responses on the website through Chrome's developer tool.
