Mail Injection Exploit Warning

I’m not worried about people sending me junk it’s just (some of) the messages that come through have the from field edited which I asume also means they can edit the bcc as well which is a real worry!... I’m just trying to be responsible and stopping SPAM being sent from my web server

Ah. Right. I still think that a number of people that you are getting spam from are just doing it because they think it will get published on the site and they can increase their google rank for "cheap airfares" etc. So the receipt of those messages doesn’t necessarily mean an attempted bcc hack.

I’m confused by the "Vitalized <[email protected]>", as I just don’t know where that would come from. It is possible (I’ve not looked into it) that the script is already defaulting back to that if there are any signs of recipient tampering.

The stripping of characters would indeed stop any attempted injection when the message body was passed to the php mailer; I haven’t looked to see what eForm already does in this respect.

Some servers force the sender to be a specific address, regardless of what you specify in the -f switch to set a specific return-path. I’m also not sure that the code in question uses the -f switch to set the return-path; either issue would most likely cause the from address to change to some default.