The key vulnerability was in the email parameter handling during registration. The pre-patch version of User.class.php used raw $email input in SQL construction (WHERE email = "$email") with only addslashes(), which is insufficient for SQL injection prevention. The fix explicitly added mysqli_real_escape_string(), confirming the lack of proper escaping was the root cause. While other functions used AddSlashes(), the registration-specific vulnerability maps directly to this email handling function. The CVE description and patch focus on SQLi via email parameter further corroborate this as the primary vulnerable function.