CVE-2014-0358

This exploit demonstrates a directory traversal vulnerability in Xangati XSR and XNR devices. It uses crafted POST requests with '../' sequences to access arbitrary files, such as '/etc/shadow'. The vulnerability allows unauthorized file access due to improper path sanitization.

This exploit demonstrates a directory traversal vulnerability in Xangati XSR and XNR devices. It uses a crafted POST request to access arbitrary files, such as /etc/shadow, by manipulating the 'file' parameter with '../' sequences.

This exploit leverages a command injection vulnerability in Xangati XSR and XNR by sending a maliciously crafted POST request to the '/servlet/Installer' endpoint. The 'params' field is manipulated to inject arbitrary commands, demonstrated here by reading '/etc/shadow'.