The vulnerability stemmed from missing validation of user-controlled 'standardfield' parameter in profile availability conditions. The patch added validation through get_standard_profile_fields() and checks via array_key_exists. The filter_user_list and get_user_list_sql functions directly used the unvalidated field name in SQL queries (visible in pre-patch code's $DB->get_records_select and WHERE clause construction). get_description had a secondary exposure but wasn't the primary injection vector. The high confidence comes from the patch's security-focused validation being added precisely to these SQL-handling functions.