Yes, it even has a name: https://en.wikipedia.org/wiki/Length_extension_attack