Pdm Product Data Management System
Monthly
SQL injection in Shandong Hoteam PDM Product Data Management System (versions up to 8.3.10) allows unauthenticated remote attackers to inject arbitrary SQL commands via the `FilterString` parameter of the `GetStoredClassByFilter` function exposed through the `/Base/BaseService.asmx/DataService` ASMX web service endpoint. A public exploit has been disclosed via a Feishu document, elevating real-world risk despite the moderate CVSS 4.0 score of 5.5. The vendor did not respond to responsible disclosure, meaning no patch is available and no remediation timeline exists.
SQL injection in Shandong Hoteam PDM Product Data Management System versions ≤8.3.9 allows remote unauthenticated attackers to execute arbitrary SQL commands via the SortOrder parameter in the GetQueryMachineGridOnePageData function of /Base/BaseService.asmx/DataService endpoint. The vulnerability enables unauthorized data access, modification, and potential service disruption (CVSS 7.3: C:L/I:L/A:L). Vendor-released patch available in version 8.3.10. EPSS data not available; no CISA KEV listing or public exploit code identified at time of analysis.
SQL injection in Shandong Hoteam PDM Product Data Management System (versions up to 8.3.10) allows unauthenticated remote attackers to inject arbitrary SQL commands via the `FilterString` parameter of the `GetStoredClassByFilter` function exposed through the `/Base/BaseService.asmx/DataService` ASMX web service endpoint. A public exploit has been disclosed via a Feishu document, elevating real-world risk despite the moderate CVSS 4.0 score of 5.5. The vendor did not respond to responsible disclosure, meaning no patch is available and no remediation timeline exists.
SQL injection in Shandong Hoteam PDM Product Data Management System versions ≤8.3.9 allows remote unauthenticated attackers to execute arbitrary SQL commands via the SortOrder parameter in the GetQueryMachineGridOnePageData function of /Base/BaseService.asmx/DataService endpoint. The vulnerability enables unauthorized data access, modification, and potential service disruption (CVSS 7.3: C:L/I:L/A:L). Vendor-released patch available in version 8.3.10. EPSS data not available; no CISA KEV listing or public exploit code identified at time of analysis.