Multiple security vulnerabilities in a commercial system of trs

Trs has multiple vulnerabilities in a commercial system, including information leakage, unauthorized access to xss, and other trs was40 products. unauthorized access direct access to was40/tree can see some background functions 2. information Leakage access was40/passwd/passwd.htm input a user name that does not exist will expose the server's intranet IP address and the possibility of brute force password cracking. 3. the submitted data is not filtered when unauthorized publishing information + xss editing information, and user logon verification is not performed. 4. some user systems have system/manager. If the email system does not restrict cookie domains, this xss vulnerability will have a greater impact.Solution:Add permissions to some was40 files. filter user submitted data. Delete the demo page and data that comes with the system according to business needs.