Prestashop - SQL injection in Presta2PhpList module

Details

	function hookRightColumn($params)
	{
		return $this->hookLeftColumn($params);
	}

 	function hookLeftColumn($params)
 	{
		[...]

		if (Tools::isSubmit('submitNewsletter'))
		{
			$this->newsletterRegistration();

	private function newsletterRegistration()
 	{
	 	if (!Validate::isEmail(pSQL($_POST['email'])))
			return $this->error = $this->l('Invalid e-mail address');
	 	/* Unsubscription */
	 	elseif ($_POST['action'] == '1')
	 	{
 		 	[...]
		}
	 	/* Subscription */
	 	elseif ($_POST['action'] == '0')
	 	{
	 	 	[...]
         	Db::getInstance()->Execute('INSERT INTO phplist_listuser VALUES ("'.$userId.'","'.$_POST['list'].'",now(),now())');

          if ($result) {
             $userId = mysql_result($result, 0);
             }
-		    		Db::getInstance()->Execute('INSERT INTO phplist_listuser VALUES ("'.$userId.'","'.$_POST['list'].'",now(),now())');
+		    		Db::getInstance()->Execute('INSERT INTO phplist_listuser VALUES ("'.$userId.'","'.intval($_POST['list']).'",now(),now())');
 		      	return $this->valid = $this->l('Subscription successful');
 			}