back door?

sneakyimp

a friend of mine hired a sketchy dude who turned out to be not just inept but possibly criminal. this guy created a custom 404 page that prompts the user for a little more info about the problem. today, the webmaster at his firm started getting thousands of emails referencing a brazillian transexual porn site (tasty!).

i can see some issues with the code but am wondering just how bad this might be from a security standpoint.

Here's the 404 page that prompts for more info. It seems like a really bad idea to me to have the entire contents of $_SERVER echoed into your form.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<?

session_name('myfriendsupport');
session_start();



if ($_SESSION['user']!='') {
	include "secure_site/functions/db.php";
	include "secure_site/functions/logging.php";
	logActivity("Invalid Page",$cid);
}


?>
<title>Page Not Found</title>
</head>

<body style="margin: 0">
<table width="100%" border="0" cellpadding="0" cellspacing="0" style="height: 69px">
 <tr>
  <td height="50" align="center" style="background-image:url(/images/head_bg.gif)">
   <table width="750" border="0" cellspacing="0" cellpadding="0">
    <tr>
     <td><a href="http://www.myfriendsdomain.com"><img src="/images/myfriend_header_logo.gif" width="200" height="50" border="0"></a></td>
    </tr>
   </table>
  </td>
 </tr>
</table>

<center>
<p>Sorry, the page you are attempting to access does not exist or could not be found.<br><br>
If you wish, you may fill out the requested information and click the button below to submit a report to the webmaster.</p>
<?php
$err_file = $_SERVER['DOCUMENT_ROOT'] . $_SERVER['REQUEST_URI'];
?>
<form name="sub" action="http://www.myfriendsdomain.com/notfound_report.php" method="POST">
<input type="hidden" name="attempt" value="<?php echo $err_file; ?>" />
<input type="hidden" name="serverinfo" value="<? print_r($_SERVER); ?>" />
Please give us a little more information such as the page you were attempting<br>
to access or the location of the broken link:<br><br>
<center><textarea name="moreinfo" rows="10" cols="60"></textarea></center> <br><br>
Please give us your email address in case we need more information:<br><br>

<input type="text" name="email" size="40" >
<input type="submit" name="submit" value="Submit Report" />

</form>
</center>
</body>

</html>

Then there is the form that handles the submission. I'm still trying to figure out where 'security_code' might get set into $SESSION and also into $POST but no luck yet. It would appear that it is in fact being done, however, because emails do get sent from this page:

<?php
if ($_SERVER['REQUEST_METHOD'] == "POST") {
  session_name('myfriendsupport');
  session_start(); 
  if(($_SESSION['security_code'] == $_POST['security_code']) && (!empty($_SESSION['security_code'])) ) {
    // Insert you code for processing the form here
    $_SESSION['security_code'] = '';
    $_POST['security_code'] = '';
    $page = $_POST['attempt'];
    $moreinfno = $_POST['moreinfo'];
    $email = $_POST['email'];
    $server_stuff = $_POST['serverinfo'];
    if ($page != '' && $server_stuff != '') { 
      ini_set("SMTP", "smtp.myfriend.com");
      $message = "A user has submitted a Page Not Found error report to you.


The page they were attempting to access is:


$page
More Info:


$moreinfo
Email:


$email
Please look into this matter promptly.


Thank you,


Your Trusty Web Server
Additional Server Information:


$server_stuff";
      mail("webmaster@myfriend.com", "Page Not Found Error Report", $message, "From: webmaster@myfriend.com");
    }
?>
<html>
<head>
<title>myfriend Widget Systems, Inc.</title>
</head>
<body leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">
<table width="100%" height="69" border="0" cellpadding="0" cellspacing="0">
 <tr>
  <td height="50" align="center" background="../images/head_bg.gif">\
   <table width="750" border="0" cellspacing="0" cellpadding="0">
    <tr>
      <td><a href="http://www.myfriendsdomain.com"><img src="../images/myfriend_header_logo.gif" width="200" height="50" border="0"></a></td>
    </tr>
   </table>
  </td>
 </tr>
 <tr>
  <td height="19" background="../images/nav_bg.gif">&nbsp;</td>
 </tr>
</table>
<br>
<p align="center">Thank you, your report has been submitted.</p>
<p align="center">You may <a href="http://www.myfriendsdomain.com/">click here</a> to return to the main myfriend Widget, Inc. web site.</p>
</body>
</html>
<?
  } else {
?>
<html>
<head>
<title>myfriend Widget Systems, Inc.</title>
</head>
<body leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">
<table width="100%" height="69" border="0" cellpadding="0" cellspacing="0">
 <tr>
  <td height="50" align="center" background="../images/head_bg.gif">
   <table width="750" border="0" cellspacing="0" cellpadding="0">
    <tr>
     <td><a href="http://www.myfriendsdomain.com"><img src="../images/myfriend_header_logo.gif" width="200" height="50" border="0"></a></td>
    </tr>
   </table>
  </td>
 </tr>
</table>
<br>
<p align="center">Sorry, you have provided an invalid security code.</p>
<p align="center"><input type="button" value="Go Back" onclick=history.go(-1)></p>
</body>
</html>
<?
    exit(0);
  }
} else {
  header("Location: http://www.myfriendsdomain.com");
  exit(0);
}
?>

Here is an example of the email being sent by the form handler:

From: mfwebmaster@myfriend.com
Date: December 28, 2006 12:30:21 PM CST
To: mfwebmaster@myfriend.com
Subject: Page Not Found Error Report
Message-Id: <foo-OWAjmMPqngL00000b3f@mailca.myfriend.com>

A user has submitted a Page Not Found error report to you.

The page they were attempting to access is:
E:/cmsapp/sitehttp://www.brazilian-transsexuals.com/members/amembers.html


More Info:

Email:
DELAGO

Please look into this matter promptly.

Thank you,
Your Trusty Web Server

Additional Server Information:

Array

We obviously took the form and its handler down, but before doing so I visited the form (first code snip above) and noticed the $_SERVER values on display indicate a windows server with a lot of paths in the include path. does this represent a security risk? i've never seen that many include folders in the PATH var before: