A SQL injection vulnerability exists in Shandong Hoteam Software PDM Product Data Management System versions up to 8.3.9. The flaw is in the GetQueryMachineGridOnePageData function within /Base/BaseService.asmx/DataService, where manipulation of the SortOrder argument allows remote attackers to execute SQL injection attacks. This vulnerability is addressed by upgrading to version 8.3.10.