CVE-2026-7727: Shandong Hoteam Software PDM Product Data Management

Описание

Оригинално описание

A vulnerability was determined in Shandong Hoteam Software PDM Product Data Management System up to 8.3.9. This affects the function GetQueryMachineGridOnePageData of the file /Base/BaseService.asmx/DataService. This manipulation of the argument SortOrder causes sql injection. The attack can be initiated remotely. Upgrading to version 8.3.10 is able to mitigate this issue. You should upgrade the affected component.

Засегнати продукти

• Shandong Hoteam Software PDM Product Data Management System: 8.3.0; 8.3.1; 8.3.2; 8.3.3; 8.3.4; 8.3.5; 8.3.6; 8.3.7; 8.3.8; 8.3.9; 8.3.10

Вид слабост

• CWE-89 SQL инжекция
• CWE-74 Неправилна неутрализация на специални елементи в изходни данни

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-7727
• https://nvd.nist.gov/vuln/detail/CVE-2026-7727
• https://vuldb.com/vuln/360902
• https://vuldb.com/vuln/360902/cti
• https://vuldb.com/submit/803268
• https://ucn9h68n9289.feishu.cn/wiki/KvbxwRlmRihO8ZkT1E1c64pdngh
• https://en.hoteamsoft.com/pdm