Exploitation Summary
EIP tracks 3 public exploits for CVE-2014-0358. PoCs published by Jan Kadijk.
AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in Xangati XSR and XNR devices. It uses crafted POST requests with '../' sequences to access arbitrary files, such as '/etc/shadow'. The vulnerability allows unauthorized file access due to improper path sanitization.
Description
Multiple directory traversal vulnerabilities in Xangati XSR before 11 and XNR before 7 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the file parameter in a getUpgradeStatus action to servlet/MGConfigData, (2) the download parameter in a download action to servlet/MGConfigData, (3) the download parameter in a port_svc action to servlet/MGConfigData, (4) the file parameter in a getfile action to servlet/Installer, or (5) the binfile parameter to servlet/MGConfigData.
Exploits (3)
This exploit demonstrates a directory traversal vulnerability in Xangati XSR and XNR devices. It uses crafted POST requests with '../' sequences to access arbitrary files, such as '/etc/shadow'. The vulnerability allows unauthorized file access due to improper path sanitization.
This exploit demonstrates a directory traversal vulnerability in Xangati XSR and XNR devices. It uses a crafted POST request to access arbitrary files, such as /etc/shadow, by manipulating the 'file' parameter with '../' sequences.
This exploit leverages a command injection vulnerability in Xangati XSR and XNR by sending a maliciously crafted POST request to the '/servlet/Installer' endpoint. The 'params' field is manipulated to inject arbitrary commands, demonstrated here by reading '/etc/shadow'.