Reply to Re: abused mailscript => How did they do it???
Posted by rlee0001 on 03/14/06 11:08
Q, you are not checking POST name and POST email for new line
characters. That enables the user to inject any headers they want. In
theory this could allow CC: to be used to send mail to other users.
Validate/filter the POST data for invalid characters. Alternatively
don't allow the user to submit header-related information.