Okay, I
think this should fix it.
Try it out and see if you can still exploit it.
note: the attached plugin originates from the 3.8 version which is now in the graveyard, but it should probably work for 3.7 as well
edit: er, apparently vBulletin doesn't prompt you to overwrite plugins which is kinda lame (heh, been a while since I've uploaded plugins rather than products).
You should delete "Cyb - Login To User Account - MI" and then upload my attachment.