full-disclosure - thesitewizard.com chfeedback.pl CRLF Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <bfaf2f4a05090511077135ef59@mail.gmail.com>
Date: Mon Sep  5 19:07:42 2005
From: deathtrip at gmail.com (deathtrip)
Subject: thesitewizard.com chfeedback.pl CRLF Injection

The "Perl Feedback Form CGI Script" (chfeedback.pl) located at
http://www.thesitewizard.com/wizards/feedbackform.shtml prior to
10/05/2005 lacked variable sanitization, and as such allowed for CRLF
injection. This allowed anyone to add email fields (such as Bcc:) via
a crafted URL, and send gobs of spam as a result. I notified the
vendor yesterday, and although I haven't received any response yet
(nor would I expect to in such a short amount of time), I noticed that
the script has been updated with proper sanitization.

Old version: chfeedback.pl Feedback Form Perl Script Ver 2.01
New version: chfeedback.pl Feedback Form Perl Script Ver 2.2.1

No proof of concept - I don't support giving spammers any more
information than this.

If you have users using this form, you can add the following 2 lines
to the send_email() subroutine just before the line:

        if (open MAIL, "|$mailprog -t") {

Update with this:

        $name   =~ s/[\r\n].*//s;
        $email  =~ s/[\r\n].*//s;