A simple Example of a vulnerable Download PHP Script

<?php

$id = $_GET["id"]; //Vulnerable Parameter

$con=mysqli_connect("localhost","root","","tutorial");

$result = mysqli_query($con, "SELECT `filename`, `location` FROM `downloads` where `id`=$id");

while($row = mysqli_fetch_row($result))
{
        $filename = $row[0];
        $location = $row[1];
}

mysqli_close($con);

header('Content-Disposition: attachment; filename='.$filename);
readfile($location);