MyBB 1.0 SQL injection in uploading file

[addmimistrator@xxxxxxxxx]

Hey
there is a security bug in inc/function_upload.php script in mybb all version 
(except two days ago security updated version) that allows SQL INJECTION
this bug is in function of upload attachment .
when a file goes to upload this function test that if file has a valid 
extension . for this call getextension  function and fetch all of characters 
after last period sign. then make a query and search in valid extensions table 
and here a file with quoted extension include sql statement will be execute.
this bug reported to mybb offical site and patched as a security patch in 
internal version 1.0.1 two days ago
be beauty
imei