CVE-2026-7727

Shandong Hoteam Software PDM Product Data Management System DataService GetQueryMachineGridOnePageData sql injection

View on CVE.org
Published May 4, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in Shandong Hoteam Software PDM Product Data Management System up to 8.3.9. This affects the function GetQueryMachineGridOnePageData of the file /Base/BaseService.asmx/DataService. This manipulation of the argument SortOrder causes sql injection. The attack can be initiated remotely. Upgrading to version 8.3.10 is able to mitigate this issue. You should upgrade the affected component.

Analysis

AI-generated

Technical impact

A flaw in the GetQueryMachineGridOnePageData function of Shandong Hoteam Software’s PDM Product Data Management System lets attackers manipulate the SortOrder argument without proper sanitization, causing the back-end database to execute arbitrary SQL statements. This can enable attackers to read, modify or delete sensitive data that the application normally protects, and in some configurations could lead to higher level control over the system.

Affected Systems

Systems running Shandong Hoteam Software PDM Product Data Management System versions up to and including 8.3.9 are vulnerable. The issue resides in the /Base/BaseService.asmx/DataService endpoint and affects any deployment that exposes this service to remote clients.

Risk and Exploitability

The CVSS score of 6.9 reflects a moderate‑to‑high severity, while the lack of an EPSS ranking or KEV listing suggests exploitation has not yet been widely reported but remains possible. Because the vulnerability can be triggered remotely by crafting a specific API call, an attacker only needs network reach to the exposed service to leverage it. The attack could compromise confidentiality and integrity of the organization’s data assets.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the PDM Product Data Management System to version 8.3.10 or later immediately.
  • Restrict external access to the /Base/BaseService.asmx/DataService endpoint using firewall rules or network segmentation so only trusted internal systems can reach it.
  • Apply a web application firewall rule or server‑side validation to reject or properly escape unsanitized input in the SortOrder parameter, protecting against future injection attempts.

Generated by OpenCVE AI on May 4, 2026 at 05:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Shandong Hoteam Software
Shandong Hoteam Software pdm Product Data Management System
Vendors & Products Shandong Hoteam Software
Shandong Hoteam Software pdm Product Data Management System
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in Shandong Hoteam Software PDM Product Data Management System up to 8.3.9. This affects the function GetQueryMachineGridOnePageData of the file /Base/BaseService.asmx/DataService. This manipulation of the argument SortOrder causes sql injection. The attack can be initiated remotely. Upgrading to version 8.3.10 is able to mitigate this issue. You should upgrade the affected component.
Title Shandong Hoteam Software PDM Product Data Management System DataService GetQueryMachineGridOnePageData sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 4, 2026, 12:54 PM
Reserved
May 3, 2026, 3:54 PM

View source JSON

Updated
May 4, 2026, 12:53 PM

JSON

Status
Deferred
Published
May 4, 2026, 5:16 AM
Modified
Oct 26, 2026, 7:10 PM

View source JSON

No data.

Updated
May 4, 2026, 4:06 PM

JSON