473,420 Members | 1,574 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,420 software developers and data experts.

Mail insertion hack on Send Mail form

I'm using CDO to send mail to the site owner from ASP pages with forms.
Recently one of my forms is occasionally sending email with what seems
to be an insertion which is replacing the plain text part of the email
with something else. Looking at the server sent email source, the
hacked emails have the following:

This is a multi-part message in MIME format.
------=_NextPart_000_0001_01C60610.91D1FFA0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: base64
QmVsb3cgaXMgdGhlIHJlc3VsdCBvZiB5b3VyIHJlcXVlc3QgZm 9yIGluZm8gZm9ybS4...etc
.....................S0tLS0tLS0tLS0tLS0tLS0tLS0tLS 0tLS0NCi0tLQ0K
------=_NextPart_000_0001_01C60610.91D1FFA0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
.......the correct html content

On a non-hacked email the content is:

This is a multi-part message in MIME format.
------=_NextPart_000_0001_01C5FD9B.47C9C190
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Below is the result of your request......
.........the correct plain text content
------=_NextPart_000_0001_01C5FD9B.47C9C190
Content-Type: text/html
Content-Transfer-Encoding: 7bit
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
.......the correct html content

How can I prevent this happening?
What is the evil hacker attempting to include?
Apart from the submitter's email address and links to a chinese site,
all the rest of the characters in the submission are non-english
(irrelevant no doubt).
I am changing the form to include a server generated value which will
make it harder for this to be done by posting to the page without going
to the form first. I am clipping all form entries to reasonable sizes.
What can I look for in or strip from the form submission to decide to
trash the attempt?
Colin

Dec 23 '05 #1
0 2120

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

2
by: Mark Creelman | last post by:
Hi: I am relatively new to ASP. I prefer Perl, but need to do this form to e-mail sipt for a web page, See Example of script below that works fine. I want to add the feature to this where it...
16
by: polilop | last post by:
I made a form in which I send the visitor a link to my page but when the visitor gets that link in the mail it dosent send him to the page just says invalid syntax or something like...
3
by: Kassam | last post by:
Hi MVPs out there. I have constructed an order form and the users will enter the informtion. I now need to send the filled out form as an e-mail (body being the HTML with the fille din data) to...
6
by: DigitalRick | last post by:
I have been running CDONTS in my ASPpages to send emails to me sent from my guestbook. It had been working fine untill I upgraded to Server 2003 (I am also running Exchange 2003) all locally. I...
5
by: ElanKathir | last post by:
Hi ! I wrote one code for Send the E-mail, But that code have some problem , So please help me Here i paste my code and Error: Error: Server Error in '/Elan_Sample' Application. ...
4
by: Angelos | last post by:
Hi, Because I am fed up with attacks on my form mail scripts I want to find a way to hack them my self and test it while I am developing it.... Does anyone knows a good resource to learn how...
3
by: jlaustill | last post by:
Hey yall, I have a problem, I'm a DBA for about 250 databases. I currently have ZERO means of notification on them. I put together an entire plan for using SQL mail, got a pop3 account set up...
4
by: Jason | last post by:
I'm troubleshooting a program that I didn't build, so forgive me on this one. It's called email.php, and it looks like a program that the original developer must have downloaded from somewhere. ...
3
uranuskid
by: uranuskid | last post by:
Hey folks, I was going to include a contact form on my website. Well, in the first place that seemed an easy thing to do with a form that prompts a PHP file validating the input vaiables and using...
0
by: emmanuelkatto | last post by:
Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud. Please let me know. Thanks! Emmanuel
1
by: nemocccc | last post by:
hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?
0
by: Hystou | last post by:
There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
0
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...
0
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...
0
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven...
0
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each...
0
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new...
0
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.