gbell wrote:
>> Also, formail scripts that require the recipient's email address to
>> be sent in from a form can be used as open relays. They can be
>> exploited by spammers to send tons of spam courtesy of your
>> formmail script. This may violate yout host's TOS.
> All the hosts I use have the formmail or something similar already
> preinstalled. I thought they could patch the script to prevent
> unauthorized use?
Possibly, but you don't know. If the script is supplied by your host,
you probably won't be TOSed for using it.
But the bottom line is that if your form has a hidden field that
specifies the recipient of the email, I can spoof the script into
sending email to anyone I want to send email to. I can use your script
to send email to multiple recipients, or even to send information about
the system to myself, such as the contents of password files, etc. It
all depends on how the script is written.
What you need to keep in mind is that I don't have to use your form to
call the script. I can create my own form, or just send your script
whatever I want to send it URL encoded. I can even create a script that
will read email addresses from a database and make your script send an
email to each of those addresses. Spammers continually looking for
poorly written form mail scripts to exploit this way.
<a style='text-decoration: underline;' href="http://www.securityfocus.com/corporate/research/top10attacks_q1_2002.shtml" target="_blank">http://www.securityfocus.com/corporate/research/top10attacks_q1_2002.shtml</a>
If the script has your email address hard-coded into it, it will only
send email to you.
--Scott<!-- ~MESSAGE_AFTER~ -->
>> Stay informed about: PDF forms