MyBB 1.4 admin remote code execution vulnerability

//index.php,336行左右

$plugins->run_hooks("index_end");
//出现了eval函数，注意参数
eval("$index = "".$templates->get("index")."";");
output_page($index);

//inc/class_templates.php,65行左右

function get($title, $eslashes=1, $htmlcomments=1)
 {
  global $db, $theme, $mybb;

  //
  // DEVELOPMENT MODE
  //
  if($mybb->dev_mode == 1)
  {
   $template = $this->dev_get($title);
   if($template !== false)
   {
    $this->cache[$title] = $template;
   }
  }

  if(!isset($this->cache[$title]))
  {
   $query = $db->simple_select("templates", "template", "title='".$db->escape_string($title)."' AND sid IN ('-2','-1','".$theme['templateset']."')", array('order_by' => 'sid', 'order_dir' => 'DESC', 'limit' => 1));
        //从数据库里面的取出模版的代码
   $gettemplate = $db->fetch_array($query);
   if($mybb->debug_mode)
   {
    $this->uncached_templates[$title] = $title;
   }

   if(!$gettemplate)
   {
    $gettemplate['template'] = "";
   }

   $this->cache[$title] = $gettemplate['template'];
  }
  $template = $this->cache[$title];

  if($htmlcomments)
  {
   if($mybb->settings['tplhtmlcomments'] == 1)
   {
    $template = "<!-- start: ".htmlspecialchars_uni($title)." -->n{$template}n<!-- end: ".htmlspecialchars_uni($title)." -->";
   }
   else
   {
    $template = "n{$template}n";
   }
  }

  if($eslashes)
  {
   $template = str_replace("'", "'", addslashes($template));
  }
  return $template;
 }