This vulnerability involves an SQL injection in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV2. Specifically, the issue arises from improper input validation of the 'sort' parameter in the /SubstationWEBV2/app/..;/calc/getCalcmeterDetailDayListTree endpoint, enabling an unauthenticated remote attacker to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The vendor has not issued any advisory or patch, and the exploit is publicly available, increasing potential risk.

Successful exploitation could allow an unauthenticated remote attacker to perform SQL injection attacks, potentially leading to unauthorized data access or manipulation within the affected platform. The exact impact scope is limited by the CVSS vector indicating low to limited confidentiality, integrity, and availability impact. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing application-layer protections such as web application firewalls (WAFs) to detect and block SQL injection attempts targeting the vulnerable endpoint. Monitoring for unusual database queries or access patterns related to the 'sort' parameter may also help mitigate risk until an official patch is available.