PHPFormMail Arbitrary Recipient Mail Relay Vulnerability

Bugtraq ID:	4704
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 07 2002 12:00AM
Updated:	May 07 2002 12:00AM
Credit:	Published in the PHPFormMail Changelog.
Vulnerable:	PHPFormMail PHPFormMail 1.0 3.0
Not Vulnerable:	PHPFormMail PHPFormMail 1.0 3.1

PHPFormMail Arbitrary Recipient Mail Relay Vulnerability

PHPFormMail is designed to be a replacement for Matt Wright's FormMail script implemented in the PHP programming language. PHPFormMail is used to send email defined by a number of CGI parameters.

A vulnerability exists in some versions of PHPFormMail. The recipient of the email is specified by a CGI parameter. As a result, a malicious user may trivially specify any email address, effectively using the script as an open mail relay. This technique is well known, and commonly used for sending unsolicited commercial email.

PHPFormMail Arbitrary Recipient Mail Relay Vulnerability

Solution:
An updated version is available.


PHPFormMail PHPFormMail 1.0 3.0

• PHPFormMail phpformmail_classic-1.03.1.tar.gz
  http://freshmeat.net/redir/phpformmail/18771/url_tgz/phpformmail_class ic-1.03.1.tar.gz

PHPFormMail Arbitrary Recipient Mail Relay Vulnerability

References:

• PHPFormMail Homepage (PHPFormMail)