PunBB pun_attachment上传附件扩展sql注射漏洞

本来想给论坛加个上传附件的功能，从官方网站下了个punattachment，顺便看了下代码，结果发现了这个漏洞:p if isset$GET'securestr' if pregmatch'\d+f\d+', $GET'securestr', $match ... 'WHERE' = 'a.id = '.$attachitem.' AND fp.readforum IS NULL OR fp.readforum = 1 AND securestr = ''.$GET'securestr'.'''...