XSS via curl
| From: | Sandy Keathley | Date: | Wed, 30 Nov 2005 14:59:05 +0000 |
| Subject: | XSS via curl | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-226644@lists.php.net to get a copy of this message | ||
My company uses a home-grown formmail script for clients
<groan>, and someone is using curl to inject HTTP headers and
spam email addresses, and turn it into an open relay. Yes, I know
the right answer is to not use a formmail, but I don't make the rules
here.
Is there a way to detect that a script is being accessed by curl, and
not by a browser? ENV ($_SERVER) variables won't work, as
those can be forged.
Thanks.
Sandy Keathley