diff -ur ZoneMinder-1.25.0_orig/web/includes/functions.php ZoneMinder-1.25.0/web/includes/functions.php
--- ZoneMinder-1.25.0_orig/web/includes/functions.php	2011-08-03 18:33:59.000000000 +0100
+++ ZoneMinder-1.25.0/web/includes/functions.php	2013-03-16 11:10:10.742835042 +0000
@@ -905,7 +905,7 @@
 
 function packageControl( $command )
 {
-    $string = ZM_PATH_BIN."/zmpkg.pl $command";
+    $string = ZM_PATH_BIN."/zmpkg.pl ".escapeshellarg( $command );
     $string .= " 2>/dev/null >&- <&- >/dev/null";
     exec( $string );
 }
@@ -2145,7 +2145,8 @@
     else
     {
         // Can't connect so use script
-        $command = ZM_PATH_BIN."/zmx10.pl --command $status --unit-code $key";
+        $command = ZM_PATH_BIN.'/zmx10.pl --command '.escapeshellarg( $status );
+        $command .= ' --unit-code '.escapeshellarg( $key );
         //$command .= " 2>/dev/null >&- <&- >/dev/null";
         $x10Response = exec( $command );
     }