EUVD-2026-53011
GHSA-29v6-h4xg-jpwm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated ASMX endpoint with no prerequisites; limited but confirmed read, write, and availability impact on the vulnerable database system.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in Shandong Hoteam PDM Product Data Management System (versions up to 8.3.10) allows unauthenticated remote attackers to inject arbitrary SQL commands via the FilterString parameter of the GetStoredClassByFilter function exposed through the /Base/BaseService.asmx/DataService ASMX web service endpoint. A public exploit has been disclosed via a Feishu document, elevating real-world risk despite the moderate CVSS 4.0 score of 5.5. The vendor did not respond to responsible disclosure, meaning no patch is available and no remediation timeline exists.
Technical ContextAI
The affected component is an ASP.NET ASMX web service (DataService) hosted at /Base/BaseService.asmx/DataService, a legacy .NET remoting surface common in older enterprise applications. The GetStoredClassByFilter function accepts a FilterString argument that is likely concatenated directly into a backend SQL query without parameterization or sanitization, constituting a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw. The CPE string cpe:2.3:a:shandong_hoteam:pdm_product_data_management_system:*:*:*:*:*:*:*:* covers all versions up to and including 8.3.10. ASMX endpoints are typically exposed over HTTP/HTTPS and may accept both GET and POST requests with named parameters, making them straightforward to interact with from any HTTP client.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor did not respond to responsible disclosure, and no fix version has been announced. As a primary compensating control, restrict network access to the /Base/BaseService.asmx/DataService endpoint using a WAF or network firewall rule to allow only trusted internal IP ranges; this directly removes the AV:N attack surface but may break legitimate remote integrations. Deploy a WAF with SQL injection detection rules (e.g., OWASP ModSecurity Core Rule Set) in blocking mode in front of the PDM application - note this may cause false positives on complex filter queries. If the PDM system does not require internet exposure, place it behind a VPN or segment it to an internal VLAN. Monitor database query logs for anomalous patterns such as UNION SELECT, stacked queries, or time-based blind injection markers. Reference: https://vuldb.com/vuln/385866
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today