Is my feedback form being successfully abused?
| From: | Chris W. Parker | Date: | Fri, 16 Sep 2005 16:01:26 +0000 |
| Subject: | Is my feedback form being successfully abused? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-222534@lists.php.net to get a copy of this message | ||
Hello,
About a few weeks ago I started seeing three emails that all come at the
same time (within the same minute) that seem to be trying to exploit a
feedback form I have on our website. Everytime someone submits a
feedback form I am sent the information they entered. The To and From
address are hard coded.
Here is an example message
[begin]
== Name ==
dtdegq@nonlethal.com
== Agency ==
dtdegq@nonlethal.com
Content-Type: multipart/mixed; boundary="===============1815270735=="
MIME-Version: 1.0
Subject: a8f1a36a
To: dtdegq@nonlethal.com
bcc: mhkoch321@aol.com
From: dtdegq@nonlethal.com
This is a multi-part message in MIME format.
--===============1815270735==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
thgfxnes
--===============1815270735==--
== Email ==
dtdegq@nonlethal.com
== Comment ==
dtdegq@nonlethal.com
[end]
It seems to me that the attemped exploit is unsuccessful because I
cannot find "dtdegq" or "mhko321" in /var/log/maillog. But I wanted to
send this to the list in case someone knows different.
Thanks,
Chris.