PHP Email Injection Example [Updated 2018]

Nowadays, internet usage is growing dramatically, but the vast majority of internet users don’t have a security background. Most of people use the Internet for communication with each other via email message on in regular basis. For this reason, most webmasters allowing their customers to contact them —giving a suggestion, reporting a problem, or asking for a feedback, use a contact form that will send the feedback to the webmaster’s email. Unfortunately, most of the web developers don’t have sufficient information about securing code, and some of them use a ready-made library or framework, which suffer from many well-known vulnerabilities. These are published already and have been patched by the vendor and their exploits are available on the internet, but most of the developers are too lazy to upgrade to the latest version.

Today we are going to talk about Email Injections that an attacker could use it to send out spam from your mail server using your mail form.

Email Injection

Email injection according to Wikipedia:

Email injection is a security vulnerability that can occur in Internet applications that are used to send email messages. It is the email equivalent of HTTP Header Injection. Like SQL injection attacks, this vulnerability is one of a general class of vulnerabilities that occur when one programming language is embedded within another.

When a form is added to a Web page that submits data to a Web application, a malicious user may exploit the MIME format to append additional information to the message being sent, such as a new list of recipients or a completely different message body. Because the MIME format uses a carriage return to delimit the information in a message, and only the raw message determines its eventual destination, adding carriage returns to submitted form data can allow a simple (Read more...)

Sponsorships Available

Sponsorships Available

Sponsorships Available