Destiney Links Script v2.1.2 - XSS Vulnv & Full path errors.=0D
=0D
Homepage:=0D
=0D
http://destiney.com/scripts=0D 
=0D
Description:=0D
Destiney Links is an Open Source project written in PHP for use with the MySQL Server entity.  Links provides a pre-built, dynamically generated, Link site.  Links counts referrers in and out for listed sites.  Links provides site categorization up to 5 levels dee=0D
=0D
Effected Files:=0D
index.php=0D
=0D
Exploits:=0D
=0D
Almost all files called directly from the /include/ folder and /themes/original/ displays full path disclosure errors.=0D
=0D
Input data in the Search and Add a Site forms arent filtered and sanatized. Attacks such as XSS' can occure because of that.=0D
=0D
URL injection of index.php can lead to full path disclosure errors.=0D
=0D
URL Example:=0D
http://links.destiney.com/index.php?show=pop'=0D 
=0D
Warning: include(include/pop\'.php) [function.include]: failed to open stream: No such file or directory in /home/destiney/domains/examplesite.com/public_html/index.php on line 98=0D
=0D
Warning: include() [function.include]: Failed opening 'include/pop\'.php' for inclusion (include_path='.:/usr/share/php5:/usr/share/php') in /home/destiney/domains/examplesite.com/public_html/index.php on line 98=0D