Admin News Tools Multiple Vulnerabilities

Summary
This host is installed with Admin News Tools and is prone to multiple vulnerabilities.
Impact
Successful exploitation will allow remote attackers to bypass security restrictions by gaining sensitive information and redirect the user to other malicious sites. Impact Level: Application
Solution
Upgrade to Admin News Tools version 3.0 or later For updates refer to http://www.adminnewstools.fr.nf/
Insight
- Input passed via the 'fichier' parameter in 'system/download.php' is not properly verified before being processed and can be used to read arbitrary files via a .. (dot dot) sequence. - Access to system/message.php is not restricted properly and can be exploited to post news messages by accessing the script directly.
Affected
Admin News Tools version 2.5
References