If I prove I got a shell prompt on a remote device without any authentication, do I then need to show that I can execute arbitrary code? Or is it clearly implie

If I prove I got a shell prompt on a remote device without any authentication, do I then need to show that I can execute arbitrary code? Or is it clearly implied? If the page body can read a file, then it can just execute an XmlHttpRequest to send that data to the origin server, which is the attacker in this scenario. This is just how the web works, nothing more to say about it, and no need to prove it.