CVE-2026-7727

Shandong Hoteam Software PDM Product Data Management System DataService GetQueryMachineGridOnePageData sql injection

CVSS 6.9 MEDIUMEPSS 0.3%CWE-74 CWE-89

A vulnerability was determined in Shandong Hoteam Software PDM Product Data Management System up to 8.3.9. This affects the function GetQueryMachineGridOnePageData of the file /Base/BaseService.asmx/DataService. This manipulation of the argument SortOrder causes sql injection. The attack can be initiated remotely. Upgrading to version 8.3.10 is able to mitigate this issue. You should upgrade the affected component.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

Affected products

Shandong Hoteam Software · PDM Product Data Management System

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://en.hoteamsoft.com/pdm https://ucn9h68n9289.feishu.cn/wiki/KvbxwRlmRihO8ZkT1E1c64pdngh https://vuldb.com/submit/803268 https://vuldb.com/vuln/360902 https://vuldb.com/vuln/360902/cti