note 55112 deleted from ref.mail by didou
| From: | didou@php.net | Date: | Sun, 23 Apr 2006 22:30:59 +0000 |
| Subject: | note 55112 deleted from ref.mail by didou | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-109201@lists.php.net to get a copy of this message | ||
Note Submitter: jfonseca at matarese dot com
----
Hi, from the example below :
$headers .= "From: \"".$fromname."\"
<".$fromaddress.">\n";
return mail($toaddress, $subject, $message, $headers);
This will allow a SMTP injection attack on your feedback form.
Make sure you end your headers with \r\n\r\n or the missing \r\n will allow the attacker to inject
additional headers.
The main use for this common flaw is to use your contact form for spam.
Remember: always triple-check user input that does anything meaningful.