Sql injection and global variables poisoning in XMB Forum 1.9.1

Vendor notified at and partial patch: http://forums.xmbforum.com/viewthread.php?tid=754523 firstly the input validation at xmb.php: foreach $global as $num = $array if isarray$array extract$array, EXTROVERWRITE; this should put to not overwrite any variables cause it overwrite server set variable...