MyBB 1.4 admin remote code execution vulnerability

//admin/modules/style/templates.php,372行开始

 if($mybb->input['action'] == "edit_template")
{
 $plugins->run_hooks("admin_style_templates_edit_template");

 if(!$mybb->input['title'] || !$sid)
 {
  flash_message($lang->error_missing_input, 'error');
  admin_redirect("index.php?module=style/templates");
 }

 if($mybb->request_method == "post")
 {
  if(empty($mybb->input['title']))
  {
   $errors[] = $lang->error_missing_title;
  }

  if(!$errors)
  {
   $query = $db->simple_select("templates", "*", "tid='{$mybb->input['tid']}'");
   $template = $db->fetch_array($query);
   //获取到我们输入的内容，包括模板的标题和内容
   $template_array = array(
    'title' => $db->escape_string($mybb->input['title']),
    'sid' => $sid,
    'template' => $db->escape_string(trim($mybb->input['template'])),
    'version' => $mybb->version_code,
    'status' => '',
    'dateline' => TIME_NOW
   );

   // Make sure we have the correct tid associated with this template. If the user double submits then the tid could originally be the master template tid, but because the form is sumbitted again, the tid doesn't get updated to the new modified template one. This then causes the master template to be overwritten
   $query = $db->simple_select("templates", "tid", "title='".$db->escape_string($template['title'])."' AND (sid = '-2' OR sid = '{$template['sid']}')", array('order_by' => 'sid', 'order_dir' => 'desc', 'limit' => 1));
   $template['tid'] = $db->fetch_field($query, "tid");

   if($sid > 0)
   {
    // Check to see if it's never been edited before (i.e. master) of if this a new template (i.e. we've renamed it)  or if it's a custom template
    $query = $db->simple_select("templates", "sid", "title='".$db->escape_string($mybb->input['title'])."' AND (sid = '-2' OR sid = '{$sid}' OR sid='{$template['sid']}')", array('order_by' => 'sid', 'order_dir' => 'desc'));
    $existing_sid = $db->fetch_field($query, "sid");
    $existing_rows = $db->num_rows($query);
    //更新模版数据库
    if(($existing_sid == -2 && $existing_rows == 1) || $existing_rows == 0)
    {
     $tid = $db->insert_query("templates", $template_array);
    }
    else
    {
     $db->update_query("templates", $template_array, "tid='{$template['tid']}' AND sid != '-2'");
    }
   }