note 55256 deleted from ref.mail by didou

Note Submitter: thomas at nospam dot deliduka dot com ---- Last night we had a spammer use our form-to-mail system to send spam. I had protected the 'to' field in the function so I couldn't understand how they were using it to send to other people. So, I added tracking information to anyone who posts to the form and they tried again this morning. This is what I found out. They were posting a message within a message. In all the variables sent with the form they had this (they were using another program to post directly to the form): vltrwe@domain.com Content-Type: multipart/mixed; boundary="===============1998658368==" MIME-Version: 1.0 Subject: 9c954098 To: victim@domain.com bcc: victim@domain2.com From: vltrwe@domain.com This is a multi-part message in MIME format. --===============1998658368== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit SPAM MESSAGE HERE. --===============1998658368==-- So, the system, when passed this information in the header of the e-mail thought it was the continuation of the format and it sent the additional email data and thus spam goes out. Clear as mud? I have never seen such a clever, if you will, hacking tool. This is downright devious. Protect ANY variables being sent to ANY function. I am looking for "Content-Type:" since I am sure this is the only way to do this. If it's not, I'll know about it because my tracking data is still there.