It's actually a GET request - http://d.pr/i/SRPX.  Either way though, a check for int/is_numeric() would be more appropriate than esc_attr().  To be clear though, I'm not actually seeing how this is a vulnerability.  If it's more obvious to you, you have me on Skype. :)