CVE:CVE-2020-7357
CNNVD:CNNVD-202006-1226
CAYIN Technology CMS是中国台湾铠应科技（CAYIN Technology）公司的一套内容管理系统（CMS）。
CAYIN Technology CMS中的system.cgi文件存在操作系统命令注入漏洞。远程攻击者可借助‘NTP_Server_IP’参数利用该漏洞以root用户身份执行注入的任意shell命令。以下产品及版本受到影响：CAYIN Technology CME-SE；CMS-60；CMS-40；CMS-20；CMS。
solution:Upgrade cayintech cms-se_firmware to a higher version than 11.0:19179,11.0:19025,11.0:18325,and avoid the version 11.0:19179,11.0:19025,11.0:18325; Upgrade cayintech cms-se-lxc_firmware to a higher version than -; Upgrade cayintech cms-60_firmware to a higher version than 11.0:19025,and avoid the version 11.0:19025; Upgrade cayintech cms-40_firmware to a higher version than 9.0:14197,9.0:14199,9.0:14093,and avoid the version 9.0:14197,9.0:14199,9.0:14093; Upgrade cayintech cms-20_firmware to a higher version than 9.0:14197,9.0:14092,and avoid the version 9.0:14197,9.0:14092; Upgrade cayintech cms to a higher version than 7.5:11175,8.0:11175,8.2:12199,and avoid the version 7.5:11175,8.0:11175,8.2:12199