Spam Email

[cranachan]

Over the last few days I have been getting a lot of email spam sent from my directory. Being aware of the vulnerabilities of additional headers such as BCC: being injected via the subject or message field to fool the mailer into sending spam messages I have scripts on all my sites to strip out newlines and bcc: etc from contact forms etc. Usually this works, but this time it is persistent. I know it is happening because I get garbage mails with snippets of poems/prose and sent to funny addresses at my domain.

This time though the from address is the host address, not that used by any form on my site. This makes me think that stuff is being injected straight into PHPLD bypassing any of the mail functions.

Is this happening to anyone else, and is there a vulnerability in the PHPLD script that could let this happen?

When this happened before on other sites (not PHPLD) the spammer has given up after a while. Usually amongst the garbage is a genuine email address used to let the spammer know he has found a vulnerable script. As there is no sign of this letting up I am obviously concerned there is a vulnerability.

[gmschmitz]

I had this happen to me as well. I had to change my contact form to a contact form that had an image verification on it. Search the internet and you should be able to find one.

[Boby]

Why not use phpLD's image verification?

Boby

[gmschmitz]

The problem I was having was with my contact form that I added.

But since you brought it up I was trying to turn on the image verification right now because I keep getting sites submitted from the same emaill address, multiple poker and other sites like that and I have a Real Estate Directory. I can't get the image code to work. Can you check it out at US Real Estate Directory (http://www.us-realestatedirectory.com).

Thanks,
Gary

[insidedesign]

An additional safety step:

Create a simple line that scans the text for backlashes and have them replaced with (backslash).

[tryhard]

Hey guys

I have been noticing similar issues. For some reason I can't get PHPLD's image verification to work on my shared server.

Is anyone able to explain for a dummy how to make the safety changes discussed above in PHPLD2 - ie. which file do we change and what lines of code need to be altered ?

Many thanks
Carl