abused mailscript => How did they do it???

[Q]

Hi..

This script has been abused to send to AOL. My question "How the ... did
they do that???"

Regards,
Marco

<?

if($_POST[name] && $_POST[subject] && $_POST[text]) {
$headers = "MIME-Version: 1.0\n";
$headers .= "Content-type: text/html; charset=iso-8859-1\n";
$headers .= "X-Priority: 3\n";
$headers .= "X-MSMail-Priority: Normal\n";
$headers .= "X-Mailer: php\n";
$headers .= "From: \"".$_POST[name]."\" <".$_POST[email].">\n";

mail('s***@recipient.somewhere', "Website: ".$_POST[subject],
nl2br($_POST[text]), $headers);

echo "<META HTTP-EQUIV=Refresh CONTENT=\"2;
URL=index.php?page=contact\">Mail sent....";
}

?>

[Marcin Dobrucki]

Q wrote:

Hi..

This script has been abused to send to AOL. My question "How the ... did
they do that???" $headers .= "From: \"".$_POST[name]."\" <".$_POST[email].">\n";

mail('s***@recipient.somewhere', "Website: ".$_POST[subject],
nl2br($_POST[text]), $headers);

$_POST['email'] = 'f**@bar.com>\nBcc: <so*******@over.the.rainbow';

or something similar.

[rlee0001]

Q, you are not checking POST name and POST email for new line
characters. That enables the user to inject any headers they want. In
theory this could allow CC: to be used to send mail to other users.
Validate/filter the POST data for invalid characters. Alternatively
don't allow the user to submit header-related information.

-Robert

[Peter Fox]

Following on from Q's message. . .

Hi..

This script has been abused to send to AOL. My question "How the ... did
they do that???"
Good God! Where did you get such a naive script from?

Regards,
Marco

<?

if($_POST[name] && $_POST[subject] && $_POST[text]) {
$headers = "MIME-Version: 1.0\n";
$headers .= "Content-type: text/html; charset=iso-8859-1\n";
$headers .= "X-Priority: 3\n";
$headers .= "X-MSMail-Priority: Normal\n";
$headers .= "X-Mailer: php\n";
$headers .= "From: \"".$_POST[name]."\" <".$_POST[email].">\n";

mail('s***@recipient.somewhere', "Website: ".$_POST[subject],
nl2br($_POST[text]), $headers);

echo "<META HTTP-EQUIV=Refresh CONTENT=\"2;
URL=index.php?page=contact\">Mail sent....";
}

?>

--
PETER FOX Not the same since the cardboard box company folded
pe******@eminent.demon.co.uk.not.this.bit.no.html
2 Tees Close, Witham, Essex.
Gravity beer in Essex <http://www.eminent.demon.co.uk>

[Adam]

On Tue, 14 Mar 2006 09:30:12 +0000, Peter Fox wrote:

Following on from Q's message. . .

Hi..

This script has been abused to send to AOL. My question "How the ... did
they do that???"

Good God! Where did you get such a naive script from?

Heh ... sort of on-topic, is the original Matt [FormMail] Wright still
alive/around/rich? Sorry - not implying that *his* scripts are naive!

Adam.