Unauthenticated file write via controllable upload path

Arbitrary file upload in jshERP 3.3 allows remote attackers to write attacker-chosen files to controllable server paths. The jshERP-boot/systemConfig/upload interface accepts uploaded content without checking its file type and incorporates the biz parameter into the destination path. No authentication or user interaction is required, and successful exploitation writes attacker-controlled content at a chosen server path.