This is just such an amateur hour vulnerability. Gluing strings together with no regard to what might be in them and then parsing them later...

edit: I didn't mean it as a put-down of either the article or how they found the vulnerability, but it wasn't a constructive comment either way.