The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Email Header Manipulation

Consider the form shown in Figure 9-7, which allows users to send feedback

about the application.

Figure 9-7: A typical site feedback form

Here, users can specify a From address and the contents of the message. The

application passes this input to the PHP 

mail()

command, which constructs

the email and performs the necessary SMTP conversation with its configured

mail server. The mail generated is as follows:

To: [e-mail]

From: [e-mail]

Subject: Site problem

Confirm Order page doesn’t load

The PHP 

mail()

command uses an 

additional_headers

parameter to set

the From address for the message. This parameter is also used to specify other

headers, including Cc and Bcc, by separating each required header with a

newline character. Hence, an attacker can cause the message to be sent to arbi-

trary recipients by injecting one of these headers into the From field, as illus-

trated in Figure 9-8.