My mailform has been used by spammers :(

[floppy]

Hello
It seems that spammers have used my contact form (a simple PHP sendmail form with name, email and message fields) - I have closed that page right away and need some help before putting it back online

I'm still newbie and I don't understand how a spammers can tweak my contactform from it's initial usage... 😕

The recipient of my mail form (TO) comes from my MySQL database, the sender (FROM) and the body of my mail are filled in by the visitor (postform). The subject and a part of the message (header and signature) are predefined in my code.

I discovered the problem when looking at my stats: AWstat indicated an anormaly high traffic on my contact form page - I also received bounce-back emails (and anti-spam softwares auto-replies) - these emails where "classical" spams, without my form's pre-defined subject, header and signature. But they where using my email address as FROM sender and my server's ressources to send all that junk :mad:

• Is there a way to know if these spam are "auto-generated" or "human-generated" ?
• How to avoid beeing hijacked again ? Do you have any link, tutorial, advice ... anything ??? 😉
• Should I modify something in my PHP.ini settings ?
• Does it make any difference if I use SMTP intead of sendmail to send my contactform ? Is SMTP safer ?

Thanking you in advance for your precious help

[yelvington]

Post your PHP code. If you have register_globals enabled, it may be possible to exploit subtle bugs.

Did you examine the headers of the bounced mail to verify that the mails actually were transmitted from your Web host?

[floppy]

Yes, I checked :
the ip address that appears in the header seems to come from my web host

here is the code of my mailform:

 
// Send on submit of contactform
if (count($HTTP_POST_VARS) > 0) {
  @set_time_limit(300);
  $sm1 = new SmartMailer();
  $sm1->checkVersion("1.01");
  $sm1->smtpSetup("", "", "", "");
  $sm1->component = "Sendmail";
  $sm1->tmpFolder = "";
  $sm1->embedImages = false;
  $sm1->progressBar = "";
  $sm1->ignore_errors = true;
  $sm1->setFrom("floppy", "[e-mail]");
  $sm1->setTo("test", "[e-mail]");
  $sm1->setCc("", "");
  $sm1->setBcc("", "");
  $sm1->setSubject("Contactform");
  // using static for body
  $sm1->setBody_Static_text("langue: ".$_POST['lang']."\n\nDe la part de:\n\n".$_POST['Name']."\n".$_POST['email']."\n\ntel: ".$_POST['tel'].$_POST['message']."");
  // Attachments none
  $sm1->sendMail("one");
  $GoTo = "messagesend.htm";
  if (isset($HTTP_SERVER_VARS['QUERY_STRING'])) {
  $GoTo .= (strpos($GoTo, '?')) ? "&" : "?";
  $GoTo .= $HTTP_SERVER_VARS['QUERY_STRING'];
  }
  header(sprintf("Location: %s", $GoTo));
}
$SM_mailAction = getMailAction();

There is also an include php page that I uploaded here:

http://www.trustclip.com/86UO8D5E1QR4Le2P6DAMIDEUUOG

(I found that form in a PHP tutorial site and modified it to suit my own page. There are plenty of more advanced options in the include page (html templates, attachments) that I didn't use)

I hope this help 😉

[travelbuff]

I scanned both files and did not see any obvious vulnerabilities. Could be something subtle and specific to that class, as yelvington indicated.

Check out phorm: http://www.phorm.com - I don't think there is any way to spoof phorm on a reasonably well configured server...

[floppy]

ok thank you

maybe it's due to the serevr's setting ? As this site is hosted on a cheap shared hosting plan... security might also be cheap 😉

[Strings]

Maybe you should try something like this to prevent bots from using your mailform.

[floppy]

Thanks Strings, I'll try 🙂