Vbulletin 4.0.2 Sql Acığı

Exploit : vBulletin Yet Another Awards System 4.0.2 Time Based SQL Injection 0day
Google Dork: inurl:awards.php intext:"powered by vbulletin"

The vulnerability exists within /request_award.php.
$vbulletin->input->clean_array_gpc('p', array(
'award_id' => TYPE_UINT,
//'award_request_name' => TYPE_STR,
//'award_request_recipient_name' => TYPE_STR,
'award_request_reason' => TYPE_STR,
'award_request_uid' => TYPE_UNIT,
));