This looks like a SQL-injection vulnerability. In fairness, the rest of the code in that function is pretty opaque about how it protects against SQL injections. (e.g. you see a lot of code "$rel = CRM_Utils_Type::escape($relation[2], 'String');" then 45 lines later there's it embeds $rel in a SQL string). 

Anyway, $params['contact_sub_type'] should be passed through CRM_Utils_Type::escape()