EIP-2026-113022

This is a functional SQL injection exploit for vBulletin's Mode Secure Downloads v2.0.0r. The PoC demonstrates a UNION-based SQLi via the 'id' parameter in fileinfo.php, allowing an attacker to extract database information such as USER() and DATABASE().