2

first of all this question is for personal knowledge, and not for any kind of attack :) hope you'll believe me and give me some hints.

I'm trying to reproduce an example of mail header injection I found (link-> http://www.phpsecure.info/v2/article/MailHeadersInject.en.php). Basically it uses a form to get 3 parameters (subject, message and sender mail), then these parameters are sent with POST method and used in the php mail() function to an admin's mail.

Everything works fine, each mail is sent without problem but when I try to inject some other parameters as Cc, Bcc etc the trick doesn't work: neither \r & \n nor %0A & %0D are interpreted as CL and RF. For example, if I put my@mail.com%0ACc:foo@bar.com in the "From" field, in "my@mail.com" inbox I'll find the mail, with the same "From" field as it was sent (my@mail.com%0ACc:foo@bar.com). Does php or does input tag encode (or unencode) properly the input? How can I make it work?

Hope you can understand my bad english, thanks in advance, best regards.

ps: the article I linked is dated 2005, recently I've found that a similar bug with http headers splitting using php function "header()" was fixed, so I thought that they fixed email headers injection problem too.. But I can't find anything on the web that confirms this.

______________________EDIT________________________________________

Example working, modifying header within php code:

$to = "admin@mail.com";
$sub = "this is the subject";
$msg = "this is the message";
$header = "From: foo@foo.com"."\r\n"."Cc: bar@bar.com";
$if(mail($to, $sub, $msg, $header."\n")){
    echo "sent";
}else{
    echo "error";
}

The email is correctly received both from foo@foo.com and bar@bar.com

Examples NOT working (this is the problem I'd like to solve with your help): First example not working

Second example not working

Once I send the mail with "send" button, only foo@foo.com will get the e-mail, and in the "from" detail (inside the mail) I'll find (1st case) foo@foo.comrnCc: bar@bar.com or (2nd case)foo@foo.com%0D%0ACc: bar@bar.com.

BeNdErR
  • 17,471
  • 21
  • 72
  • 103

1 Answers1

1

I always find i need to use both \r\n in order for the headers to be sent properly.

Shane Fright
  • 385
  • 1
  • 9
  • You mean defining some string server side with php or within the user input? – BeNdErR Nov 22 '11 at 01:36
  • 1
    within the header, so say you wanted to add Content-Type: text/html and From: fright@blah.com it would look like: Content-Type: text/html\r\nFrom: fright@blah.com – Shane Fright Nov 22 '11 at 04:02
  • I've updated my first post on this thread, providing an example of what is my problem. I don't understand if your latest post is about the firs example I gave or the 2nd one: via php everything is fine, via form it doesn't work. Thanks for your help – BeNdErR Nov 22 '11 at 10:49