Zikula Core 1.3.7 is released as of 17 February 2014. This is a security release for the Core 1.3.x series as well as a bug fix release. All users of Core 1.3.0 - 1.3.6 are recommended to update as soon as possible.
In addition to addressing the security issue, the release combines all the recent "patches" that have been floating about in the community which attempted to address certain deficiencies in the 1.3.5/1.3.6 releases. Please update to this official package and discontinue using code from non-official sources.
Installation/Upgrade: (from Core 1.3.6) Be sure to backup files and database before any upgrade is attempted. Simply overwrite the files in your current installation with the new files , add your DB credentials to the config.php file and run the upgrade.php routine.
This release addresses Secunia Advisory SA56274.
A full Changelog is available