This vulnerability affects Shandong Hoteam PDM Product Data Management System up to version 8.3.10. The issue lies in the GetStoredClassByFilter function of the /Base/BaseService.asmx/DataService endpoint, where the FilterString parameter is not properly sanitized, enabling an attacker to perform SQL injection. Remote exploitation is possible without any privileges or user interaction. The vulnerability has been publicly disclosed, but the vendor has not provided a fix or response. No known exploits are reported in the wild at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or disruption of service. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, and no user interaction needed, with low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying compensating controls such as input validation, web application firewalls, or restricting access to the vulnerable service until a patch is released.