Shandong Hoteam Software PDM Product Data Management System DataService GetQueryMachineGridOnePageData sql injection
Priority HIGH 70CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
A vulnerability was determined in Shandong Hoteam Software PDM Product Data Management System up to 8.3.9. This affects the function GetQueryMachineGridOnePageData of the file /Base/BaseService.asmx/DataService. This manipulation of the argument SortOrder causes sql injection. The attack can be initiated remotely. Upgrading to version 8.3.10 is able to mitigate this issue. You should upgrade the affected component.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00313 24th percentileScored 2026-11-07
Fix Fixed PDM Product Data Management System (Shandong Hoteam Software): 8.3.10
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Shandong Hoteam Software | PDM Product Data Management System | 8.3.0; 8.3.1; 8.3.2; 8.3.3; 8.3.4; 8.3.5; 8.3.6; 8.3.7; 8.3.8; 8.3.9 | 8.3.10 | Patch available | CNA |
- PDM Product Data Management System VendorShandong Hoteam Software Affected 8.3.0; 8.3.1; 8.3.2; 8.3.3; 8.3.4; 8.3.5; 8.3.6; 8.3.7; 8.3.8; 8.3.9 Fixed in 8.3.10 Patch available CNA
Remediation
- Fix · CNA PDM Product Data Management System (Shandong Hoteam Software) Fixed in 8.3.10
Timeline
- 2026-10-02 Threatist record created from CVE-2026-7727
- 2026-10-03 Alias added: GHSA-fhcc-f43w-4vwr
References
Sources
- CVE-2026-7727 · CVE Program
- CVE-2026-7727 · NVD
- FIRST EPSS
- GHSA-fhcc-f43w-4vwr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences