Feedback Form Perl Script CHFeedBack.PL Unauthorized Mail Relay Vulnerability
BID:14749
Info
Feedback Form Perl Script CHFeedBack.PL Unauthorized Mail Relay Vulnerability
| Bugtraq ID: | 14749 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 06 2005 12:00AM |
| Updated: | Sep 06 2005 12:00AM |
| Credit: | deathtrip <[email protected]> is credited with the discovery of this vulnerability. |
| Vulnerable: |
thesitewizard.com chfeedback.pl Feedback Form Perl Script 2.0.1 |
| Not Vulnerable: |
thesitewizard.com chfeedback.pl Feedback Form Perl Script 2.2.1 |
Discussion
Feedback Form Perl Script CHFeedBack.PL Unauthorized Mail Relay Vulnerability
chfeedback.pl is prone to a vulnerability that allows the application to be abused as a mail relay.
An attacker can exploit this issue to inject arbitrary SMTP headers by using CR and LF sequences.
If successful, it becomes possible to abuse the application as a mail relay. Email may be sent to arbitrary computers. This could be exploited by spammers or other malicious parties.
chfeedback.pl is prone to a vulnerability that allows the application to be abused as a mail relay.
An attacker can exploit this issue to inject arbitrary SMTP headers by using CR and LF sequences.
If successful, it becomes possible to abuse the application as a mail relay. Email may be sent to arbitrary computers. This could be exploited by spammers or other malicious parties.
Exploit / POC
Feedback Form Perl Script CHFeedBack.PL Unauthorized Mail Relay Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
Feedback Form Perl Script CHFeedBack.PL Unauthorized Mail Relay Vulnerability
Solution:
The vendor has addressed this issue in version 2.2.1, users are urged to contact the vendor for an update.
Solution:
The vendor has addressed this issue in version 2.2.1, users are urged to contact the vendor for an update.
References
Feedback Form Perl Script CHFeedBack.PL Unauthorized Mail Relay Vulnerability
References:
References:
- Feedback Form Wizard (thesitewizard.com)
- thesitewizard.com chfeedback.pl CRLF Injection (deathtrip