dedecms v5.1 WriteBookText code injection vulnerability

function WriteBookText($cid,$body)  
{<span ></span>  
global $cfg_cmspath,$cfg_basedir;  
$ipath = $cfg_cmspath."/data/textdata";  
$tpath = ceil($cid/5000);  
if(!is_dir($cfg_basedir.$ipath)) MkdirAll($cfg_basedir.$ipath,$GLOBALS['cfg_dir_purview']);  
if(!is_dir($cfg_basedir.$ipath.'/'.$tpath)) MkdirAll($cfg_basedir.$ipath.'/'.$tpath,$GLOBALS['cfg_dir_purview']);  
$bookfile = $cfg_basedir.$ipath."/{$tpath}/bk{$cid}.php";  
$body = "&lt;"."?php\r\n".$body."\r\n?"."&gt;";  
@$fp = fopen($bookfile,'w');  
@flock($fp);  
@fwrite($fp,$body);  
@fclose($fp);  
<div  class="qt" style="display: block;">}  

</div>  

WriteBookText($arcID,addslashes($body));