An unauthenticated SQL injection vulnerability in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform allows remote attackers to compromise database integrity.

This flaw involves an improper neutralization of special elements used in an SQL command (CWE-89) within the /SubstationWEBV2/main/elecMaxMinAvgValue file, specifically affecting the fCircuitids argument. The vulnerability can be triggered remotely by unauthenticated attackers.

A successful exploit allows malicious actors to execute arbitrary database queries, potentially leading to unauthorized data access, data modification, or system disruption. Given the CVSS score of 7.3, this high severity vulnerability poses significant risks to confidentiality, integrity, and availability within enterprise power management systems.

Immediate Action: Restrict network access to the affected endpoint or disable the vulnerable module until the vendor provides a security update, as the vendor has been unresponsive.

Proactive Monitoring: Monitor database access logs for anomalous SQL queries and review web server request logs for unusual parameter inputs targeting the vulnerable endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block SQL injection patterns within the fCircuitids parameter.

Public Exploit Available: Yes, a published PoC exists, as indicated by the referenced technical writeup.

Organizations utilizing the affected Acrel platform must treat this vulnerability with high urgency due to the availability of a public proof-of-concept and the lack of an official vendor patch. Implementing robust network segmentation and WAF rules is critical to mitigate the risk of remote database compromise.