EIP-2026-113015

This exploit demonstrates a SQL injection vulnerability in vBulletin's ads_saed 1.5 via the 'user name' parameter in bnnr.php. The PoC uses blind injection techniques (ORDER BY, UNION SELECT) to extract data from the 'user' table.