Question

A client recently got a spam warning from their host.

I think I have pin pointed the issue to an old contact us form. Simple html on the front end and a simple PHP script on the back end.

    if ($_POST['submit'] == "Send"){

    //START SEND MAIL SCRIPT 
    $mail = $_POST['email'];
    $to = "[e-mail]";
    $subject = "Message from Website Contact Us Form";
    $headers = "From: Contact us Form <[e-mail]>";
    $message = "Message from Contact Us Form\n\n";
    $message .= "\nName: " . $_POST['contactname'];
    $message .= "\nEmail: " . $_POST['contactemail'];
    $message .= "\nTelephone: " . $_POST['contactphone'];
    $message .= "\n\n\nMessage:\n" . $_POST['contactmessage'];


        if(mail($to,$subject,$message,$headers)) {

                header('Location: http://www.website.co.uk/contact-us/?action=success');

        }else{

                header('Location: http://www.webisite.co.uk/contact-us/?action=fail');                          

        }//END IF MAIL

}//END SCRIPT

I know the remedies to fix it such as sanitizing post vars properly, using captchas, using a hidden ‘honeypot’ blank field, js tricks etc etc (I also like the look of this script too http://www.alt-php-faq.com/local/115/)

But to help me understand what was going on I want to know how this script is being manipulated. A foreign script posting vars to it but how do they send email to anyone apart from
‘[e-mail]’ or if they are forcing cc / bcc fields somehow why do I not get all spam as well??

Thanks

Answer 1

Line like this $message .= "\nName: " . $_POST['contactname']; can be dangerous.
If $_POST['contactname']='MegaSteve4 \r\nCc: [e-mail], [e-mail]'; are set, 2 uses will get spam mail.

See carefully. Its appending more headers. In this case Cc. I am not sure if Cc is a raw email header. But I hope you get the idea.