Description
A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-05
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the GetStoredClassByFilter function of Shandong Hoteam PDM Product Data Management System allows an attacker to inject arbitrary SQL statements through the FilterString parameter. The injection can lead to unauthorized data disclosure, modification, or denial of service against the database used by the application, consistent with CWE‑74 and CWE‑89 weaknesses.

Affected Systems

The vulnerability affects versions up to 8.3.10 of the Shandong Hoteam PDM Product Data Management System. The attack vector is the /Base/BaseService.asmx/DataService endpoint, where the FilterString argument is passed unchecked.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog, but it has been publicly disclosed and can be exploited remotely via standard HTTP requests to the DataService service. Attackers do not need authentication, making the risk significant for exposed instances.

Generated by OpenCVE AI on August 5, 2026 at 01:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the vendor’s fix or upgrade to a version that removes the vulnerability in GetStoredClassByFilter
  • Ensure that all input used in database queries, especially FilterString, is handled with parameterized statements or strict validation to eliminate injection paths
  • Limit network exposure of the /Base/BaseService.asmx endpoint by configuring firewall rules or VPN access so only trusted clients can reach it

Generated by OpenCVE AI on August 5, 2026 at 01:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection
First Time appeared Shandong Hoteam
Shandong Hoteam pdm Product Data Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:shandong_hoteam:pdm_product_data_management_system:*:*:*:*:*:*:*:*
Vendors & Products Shandong Hoteam
Shandong Hoteam pdm Product Data Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Shandong Hoteam Pdm Product Data Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-05T00:00:40.563Z

Reserved: 2026-08-04T15:53:46.665Z

Link: CVE-2026-18854

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T01:45:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')