This bug was reported to vendor and everything is ok now. That's why I public this exploit for admins of shops to test.

Exploit here:

 http://paste2.org/p/710416

Also in securityfocus

http://www.securityfocus.com/bid/37065

And

http://secunia.com/advisories/37402/

but they wrote my nickname so bad :(