[RESOLVED] my online php contact form has been hacked

[bongbong]

hi,

could anyone tell me how to stop it? i think the weirdo has been hacking the text area by exploiting the headers or something.

ta!

[NogDog]

It's hard to make specific suggestions without seeing your code; but in general, make sure you do not allow any newlines or carriage returns in any user-supplied data that will be used in any of the mail() parameters other than the message text.

[rm_-tfm]

if its a spammer, that sucks. try using a captcha script, or .htaccess blocking?

[bongbong]

thanks guys.

it is the mail header injection.

[dagon]

a couple of functions you can use

/**
Check multi-line inputs:
Returns false if text contains newline followed by
email-header specific string
/
if(eregi("/(%0A|%0D|\n+|\r+)(content-type😐to😐cc😐bcc🙂/i",$POST['name'].$POST['email'].$POST['subject'].$POST['comments']))
{$page_content .='<p class="center" style="color: #F9F; font-size: 1.2em; margin: 1em;">The script has detected you as a spammer.</p>'; $form_error="1";}

/ no new lines /
if (preg_match("/(%0A|%0D|\n+|\r+)/i",$POST['name'].$POST['email'].$_POST['subject']))
{$page_content .='<p class="center" style="color: #F9F; font-size: 1.2em; margin: 1em;">The script has detected you as a spammer (2).</p>'; $form_error="1";}

there are lots of others out there

[bongbong]

Thank you for your tips. and so...

if i do...

 $name = $_POST['name'];
  $email = $_POST['email'];
  $message = $_POST['message'];

  if (eregi("/(%0A|%0D|\\n+|\\r+)(content-type:|to:|cc:|bcc:)/i", $name.$email.$message)) { 
    exit("Spammer!");
  } 
  else {

$to = "[e-mail]";
$from = $name . "<" . $email . ">";
$subject = "Website Message";

mail($to, $subject, $message, "From: $from");

   echo 'Thank you for your message.';
  }

will it stop the hack?

[dagon]

in theory yes.

[bradgrafelman]

You could also try simply checking for any line breaks in the $email variable.

[bongbong]

it has not worked.

[Crowly]

Try to use a captcha image, heres a very simple script ive found, lots of others out there.
Image.php

<?php
header("Content-type: image/gif");
session_start();
$CAPTCHA = @imagecreate(50, 20)or die("There was a problem creating the Image string");
$bgcolor = imagecolorallocate($CAPTCHA, 255, 255, 255);
$textcolor = imagecolorallocate($CAPTCHA, 0, 0, 0);
imagestring($CAPTCHA, 4, 5, 5,  $_SESSION['image_string'], $textcolor);
imagegif($CAPTCHA);
imagedestroy($CAPTCHA);
?> 

Enter this code into your send form

//remember session_start(); somewhere in the beginning of your script.
$ImageString = rand("0", "9").rand("0", "9").rand("0", "9").rand("0", "9").rand("0", "9");
    $_SESSION['image_string'] = $ImageString;
    echo "<img src=\"image.php\" alt=\"captcha bilde\" style=\"border: 1px dotted #000000;\" />&nbsp;&nbsp;Code:&nbsp;<input type=\"text\" name=\"captcha\" />";

Somewhere before you send the mail add this check

if ($_POST['captcha']==$_SESSION['image_string']) //send mail
else echo "Code does not match, please try again";

[bongbong]

thanks again, guys.

i am just curious as to why my code above has failed to catch the regular expressions and exit from the subsequent php script?

any idea?

[dagon]

start logging what goes in to the form then test it against your blocking code and the other examples on the net.