Secunia

Some vulnerabilities have been reported in HAMweather, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to the "do_parse_code" function in Template.php, which does not properly sanitise certain parameters before using them in an eval() function. This can be exploited to execute arbitrary commands via specially crafted requests.

The vulnerability has been reported in version 3.9.8.4. Other versions may also be affected.

Solution
Update to version 3.9.8.5.

Provided and/or discovered by
James Bercegay, GulfTech Security Research

Changelog
Further details available in Customer Area

Original Advisory
http://www.gulftech.org/?node=research&article_id=00115-09302006&

Deep Links
Links available in Customer Area