Researcher: s433d_only_linux
Ref: BUGTRAQ VirtuaNews.Pro.v1.0.3.Retail.+All.Plugins Remote file Include
http://marc.info/?l=bugtraq&m=117754415631909&w=2
Extracted source code says:
include($admindirectory."/".$key.".php");
but exploit uses the "include" parameter, not $admindirectory.
I don't have time at the moment to investigate further.
- Steve