I'm nowhere near a PHP expert, but I have dabbled a bit. I can make things work just fine, but I am terrible at figuring out what is wrong. I was informed by our server admin that we have a mail script that is being abused, and I am unsure of how to remedy the issue.
I am looking for help to see how someone is using this form to send out spam mail. The issue is that we got a bounce-back email sent from an address that doesn't exist to a hotmail address using this form. As far as I know, this form ONLY sends email to the $recipient which is neither this non-existent email or this Hotmail. I am trying to figure out a way to secure this form so that individuals cannot abuse this form and send mail to others through it.
<?php
$name = check_input($_POST['name'],"Enter your name.");
$email = check_input($_POST['email'],"Email address is required.");
$company = check_input($_POST['company']);
$phone = check_input($_POST['phone']);
$message = check_input($_POST['message'],"Please don't send us a blank message! Let us know what you're thinking.");
if (!preg_match("/([\w\-]+\@[\w\-]+.[\w\-]+)/",$email))
{
show_error("E-mail address is not valid.");
}
$messageBody ="Hello!
Your contact form has been submitted by:
Name: $name
E-mail: $email
Company: $company
Phone: $phone
Message:
$message
End of message
";
$recipient = "[email protected]"; // removed real email for SE
$subject = "[Contact Form - Site Name]"; // removed site name for SE
$mailheaders = "From: [email protected]\n"; // removed real email for SE
$mailheaders .= "Reply-To:". $_POST['email']."\n\n";
mail($recipient, $subject, $messageBody, $mailheaders);
header('Location: http://www.example.com/contact/thankyou.html'); //removed real address for SE
exit();
function check_input($data, $problem='')
{
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
if ($problem && strlen($data) == 0)
{
show_error($problem);
}
return $data;
}
function show_error($mailError)
{
?>
// error message in here, removed for SE as unrelated to problem
<?php
exit();
}
?>
This is the message my server admin sent me:
-----Original Message-----
From: [email protected]
[mailto:[email protected]]
Sent: Monday, August 04, 2014 2:47 PM
To: [email protected]
Subject: failure notice
Hi. This is the qmail-send program at ss2.site-hosts.com.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.
<[email protected]>:
65.55.37.104 does not like recipient.
Remote host said: 550 Requested action not taken: mailbox unavailable Giving up on 65.55.37.104.
--- Below this line is a copy of the message.
Return-Path: <[email protected]>
Received: (qmail 6348 invoked by uid 2523); 4 Aug 2014 14:47:01 -0500
X-Qmail-Scanner-Diagnostics: from
199.192.201.219.rdns.continuumdatacenters.com by ss2.site-hosts.com (envelope-from <[email protected]>, uid 2020) with qmail-scanner-2.10st
(clamdscan: 0.98.4/19261. mhr: 1.0. spamassassin: 3.3.2. perlscan:
2.10st.
Clear:RC:1(199.192.201.219):.
Processed in 0.024127 secs); 04 Aug 2014 19:47:01 -0000
Received: from 199.192.201.219.rdns.continuumdatacenters.com (HELO
ssasi.site-hosts.com) (199.192.201.219)
by ss2.site-hosts.com with ESMTPA; 4 Aug 2014 14:47:01 -0500
Received: (qmail 15903 invoked by uid 10024); 4 Aug 2014 14:47:00 -0500
X-Qmail-Scanner-Diagnostics: from by ssasi.site-hosts.com (envelope-from <[email protected]>, uid 48) with qmail-scanner-2.10st
(clamdscan: 0.98.4/19261. mhr: 1.0. spamassassin: 3.3.2. perlscan:
2.10st.
Clear:RC:1(127.0.0.1):.
Processed in 0.013521 secs); 04 Aug 2014 19:47:00 -0000
Date: 4 Aug 2014 14:47:00 -0500
Message-ID: <[email protected]>
From: [email protected]
To: [email protected]
Subject:
X-PHP-Originating-Script: 10021:vnbMail.php
