A flaw in the GetQueryMachineGridOnePageData function of Shandong Hoteam Software’s PDM Product Data Management System lets attackers manipulate the SortOrder argument without proper sanitization, causing the back-end database to execute arbitrary SQL statements. This can enable attackers to read, modify or delete sensitive data that the application normally protects, and in some configurations could lead to higher level control over the system.

Systems running Shandong Hoteam Software PDM Product Data Management System versions up to and including 8.3.9 are vulnerable. The issue resides in the /Base/BaseService.asmx/DataService endpoint and affects any deployment that exposes this service to remote clients.

The CVSS score of 6.9 reflects a moderate‑to‑high severity, while the lack of an EPSS ranking or KEV listing suggests exploitation has not yet been widely reported but remains possible. Because the vulnerability can be triggered remotely by crafting a specific API call, an attacker only needs network reach to the exposed service to leverage it. The attack could compromise confidentiality and integrity of the organization’s data assets.