- E-mail injection
E-mail injection is a
security vulnerability that can occur inInternet applications that are used to sende-mail messages. LikeSQL injection attacks, this vulnerability is one of a general class of vulnerabilities that occur when oneprogramming language is embedded within another.When a form is added to a Web page that submits data to a Web application, a malicious user may exploit the
MIME format to append additional information to the message being sent, such as a new list of recipients or a completely different message body. Because the MIME format uses acarriage return to delimit the information in a message, and only the raw message determines its eventual destination, adding carriage returns to submitted form data can allow a simple guestbook to be used to send thousands of messages at once. A malicious spammer could use this tactic to send large numbers of messages anonymously.More information on this topic, including examples and ways to avoid the vulnerability, can be found at the [http://www.securephpwiki.com/index.php/Email_Injection SecurePHP Wiki] .However, this vulnerability is not limited to
PHP ; it can potentially affect "any" application that sends e-mail messages based on input from arbitrary users.References
* [http://www.phpsecure.info/v2/article/MailHeadersInject.php Email Headers Injection Using mail() Function] (French)
* [http://www.shaunwagner.com/projects/php/as_mail.html Simple PHP mail() replacement]
Wikimedia Foundation. 2010.