This vulnerability in Shandong Hoteam PDM Product Data Management System versions 8.3.0 to 8.3.10 involves SQL injection via the FilterString parameter in the GetStoredClassByFilter function located in /Base/BaseService.asmx/DataService. An attacker can remotely exploit this flaw without any privileges or user interaction, potentially leading to partial compromise of confidentiality, integrity, and availability of the system. The vendor has not issued a patch or official remediation, and the exploit has been publicly disclosed.

Successful exploitation allows an unauthenticated remote attacker to perform SQL injection attacks, which may lead to unauthorized data access or modification with low to limited impact on confidentiality, integrity, and availability. The CVSS 4.0 score of 6.9 reflects a medium severity with partial impact on the system's security properties.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing application-layer protections such as input validation and web application firewalls to mitigate exploitation risk until an official patch is available.