Canada's cyber centre says a patched SQL injection in Roundcube Webmail is being exploited in the wild.