Posted by rlee0001 on 03/14/06 11:08

Q, you are not checking POST name and POST email for new line
characters. That enables the user to inject any headers they want. In
theory this could allow CC: to be used to send mail to other users.
Validate/filter the POST data for invalid characters. Alternatively
don't allow the user to submit header-related information.

-Robert

• Next in forum: Re: abused mailscript => How did they do it???
• Prev in forum: Re: abused mailscript => How did they do it???
• Thread view: Re: abused mailscript => How did they do it???

[Reply to this message]