EIP-2026-113029

The exploit demonstrates a time-based SQL injection vulnerability in vBulletin Yet Another Awards System 4.0.2 via the 'award_request_uid' parameter in /request_award.php. The parameter is unsanitized and directly used in an SQL INSERT statement, allowing arbitrary SQL injection.