This vulnerability affects the uploadFileToIIS function of the /Base/BaseHandler.ashx file in Shandong Hoteam InforCenter PLM versions 8.3.0 through 8.3.8. Manipulating the File argument enables an attacker to perform unrestricted file uploads remotely. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. The vendor has not provided a patch or advisory, and the exploit code is publicly available.

Successful exploitation allows remote attackers to upload arbitrary files to the affected system, potentially leading to unauthorized file placement. This could facilitate further attacks depending on the server configuration and file handling, but the CVSS indicates limited impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is publicly available, organizations should consider implementing temporary mitigations such as restricting access to the affected upload functionality, applying web application firewalls to detect and block malicious uploads, and monitoring for suspicious activity related to file uploads. Avoid exposing the vulnerable endpoint to untrusted networks if possible.