Quote:
A spammer has been testing my contact form in an attempt to send spam through my site to a list of email addresses. Somehow, the guy automatically inserts a CC an BCC into the email message and away the spam goes!
I read this last night and it scared the sh*t out of me.
I've got a few XOOPS sites setup and the thought if this happening on any of them scared me even more!!
I decided to look at the contact form's code (index.php v1.12.12.1) and:
$xoopsMailer->setToEmails($xoopsConfig['adminmail']);
$xoopsMailer->setFromEmail($usersEmail);
$xoopsMailer->setFromName($xoopsConfig['sitename']);
$xoopsMailer->setSubject($subject);
$xoopsMailer->setBody($adminMessage);
I can see that there is no way to change the destination (at least how I understand it, because of
$xoopsMailer->setToEmails($xoopsConfig['adminmail']);
This is always sent to the adminmail email. I also can't see how a CC or a BCC can be injected into the $xoopMail->setToEmails() method.
The $usersEmail does get checked for validity in:
if ( ! ( $usersEmail = checkEmail( $myts->stripSlashesGPC($_POST['usersEmail']) ) ) ) {
redirect_header( XOOPS_URL . "/modules/" . $xoopsModule->getVar('dirname') . "/index.php", 2, _CT_INVALIDMAIL );
exit();
}
So tried keying in two email addresses separated by /n or /n and sure enough the check caught it.
Checking out xoopsmailer.php
$this->headers[] = "Return-Path: ".$this->fromEmail;
So this can be fooled if $this->fromEmail contains email+carriage return+CC:email or BCC:email.
So it does depends how well the $userEmail check works.
function checkEmail($email,$antispam = false)
{
if (!$email || !preg_match("/^[_a-z0-9-]+(.[_a-z0-9-]+)*@[a-z0-9-]+([.][a-z0-9-]+)+$/i",$email)){
return false;
}
if ($antispam) {
$email = str_replace("@", " at ", $email);
$email = str_replace(".", " dot ", $email);
}
return $email;
}
I can see that the code checks for a valid email, using the given regex pattern. I am no expert in regex but I ran a few tests and the following emails failed.
test@test.comnCC:test@test2.com Invalid email
test@test.comrCC:test@test2.com Invalid email
"test@test.comrCC:test@test2.com" Invalid email
From my basic (and quick) investigation, I cannot see how this can be possible via the contact form.
Could I ask someone more knowledgeable than me in regex and phpmailer to please look at this.
Cheers.
McNaz.
