Shandong Hoteam Software PDM SQL Injection Vulnerability in Data Service Endpoint

A remote SQL injection vulnerability has been identified in the Shandong Hoteam Software Product Data Management (PDM) System, affecting versions prior to 8.3.10. The vulnerability arises in the GetQueryMachineGridOnePageData function of the /Base/BaseService.asmx/DataService file. This issue allows for unauthenticated SQL injection by manipulating the SortOrder argument, and the affected endpoint can be accessed remotely.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Remediation

Users are advised to upgrade to version 8.3.10 or later to address this vulnerability.