SQL Injection in Shandong Hoteam PDM Product Data Management System

A critical SQL injection vulnerability (CVE-2026-18854) has been identified in the Shandong Hoteam PDM Product Data Management System in versions up to 8.3.10. The vulnerability resides within the GetStoredClassByFilter function in the /Base/BaseService.asmx/DataService file. By sending a specially crafted 'FilterString' argument to this endpoint, an unauthenticated, remote attacker can manipulate backend database queries. This flaw poses a significant risk to organizational data integrity and confidentiality, as it enables unauthorized access to the underlying database management system. Publicly available exploit material has been disclosed, and as the vendor has not provided a resolution, administrators are urged to restrict network access to the affected web service components immediately.

Attack Chain

1. The attacker performs reconnaissance to identify internet-facing PDM web services utilizing the vulnerable /Base/BaseService.asmx endpoint.
2. The attacker identifies the target endpoint, /Base/BaseService.asmx/DataService, responsible for handling class filtering requests.
3. The attacker crafts a malicious HTTP GET or POST request targeting the 'FilterString' parameter within the GetStoredClassByFilter function.
4. The input is passed directly to the backend database engine without proper sanitization or parameterization.
5. The injected SQL command is executed by the database, allowing the attacker to bypass access controls, exfiltrate data, or modify database entries.
6. If the database service account has excessive privileges, the attacker may further leverage the injection to interact with the underlying host OS.
7. The final objective is typically data exfiltration or the establishment of persistent unauthorized database access.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary SQL commands against the backend database. This can lead to the unauthorized disclosure of sensitive product data, modification of existing records, or complete compromise of the database integrity. Given that the product manages proprietary engineering and product design data, the impact of a breach could include the loss of sensitive intellectual property and disruption of manufacturing processes.

Recommendation

• Deploy the provided webserver-level detection rule to identify and block incoming requests containing suspected SQL injection patterns directed at the /Base/BaseService.asmx/DataService endpoint.
• Restrict access to the PDM web management interface to internal, trusted network segments via firewall controls to mitigate the remote exploitation vector.
• Audit database access logs for unusual queries or bulk data retrieval patterns originating from the application service account to detect potential exploitation activity.
• If the software cannot be patched, consider placing a Web Application Firewall (WAF) in front of the application to inspect and filter the 'FilterString' parameter for SQL injection payloads.