Local File Inclusion vulnerability in admin/index.php in TinyWebGallery 1.7.6 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include local files via the lang parameter, which leads to execute arbitrary PHP code by injecting data into the log files.
CVE Link
Product Name