Member Avatar for Karpat

Hi -

I have had a message today from my hosting company to tell me that one of the sites on my hosting account is having it's php code abused. Apparently someone is manipulating the php code from the contact form to allow them
to add Bcc addresses.

Any ideas on what I need to do to close this loop hole?

Thanks.

  • 3 Contributors
  • 3 Replies
  • 93 Views
  • 11 Hours Discussion Span
  • Latest Post Latest Post by stymiee

Dani AI

Generated

The hosting alert described by points to header-injection abuse of a PHP contact handler. and are on the right track: attackers are getting user input treated as mail headers. The immediate goal is to stop untrusted data from ever being used to build header lines and to audit how the form is being called from the web.

Practical checklist (in order):

  • Take the form offline or change the recipient to a sandbox address while investigating.
  • Audit the mail-sending code paths and any place that concatenates user input into headers or subjects. Search for direct mail calls or custom header variables.
  • Strictly validate addresses server-side (for example, use filter_var($email, FILTER_VALIDATE_EMAIL) in PHP) and reject anything that fails validation. Never accept arbitrary header values from form fields.
  • Replace hand-rolled header construction with a maintained mail library or authenticated SMTP transport so headers are handled safely by the library.
  • Add throttling and a bot mitigation (CAPTCHA or similar) so automated abuse is harder.
  • Keep the contact form minimal: only the fields you need; whitelist allowed fields and discard extras.

Investigation and cleanup:

  • Review web and mail logs to identify payloads and source IPs and check file modification dates for unexpected changes.
  • Rotate credentials, tighten file permissions, and update or replace old third-party contact scripts.
  • Ask the host for a sample offending message if they can provide one — it helps pinpoint the vector.

Recommended Answers

All 3 Replies

Member Avatar for stymiee

Look for 'BCC' in the form submission data. If it's there, have the script die().

Member Avatar for digital-ether

Look for 'BCC' in the form submission data. If it's there, have the script die().

You shouldn't just check for 'BCC' as many other email headers and the email body itself that can be "injected" into the email to be sent. Probably checking for newlines/linebreaks would be better.. ie: \r or \n

Member Avatar for stymiee

Agreed. :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.