Email injection

Email injection is a security vulnerability that can occur in Internet applications that are used to send email messages. It is the email equivalent of HTTP Header Injection. Like SQL injection attacks, this vulnerability is one of a general class of vulnerabilities that occur when one programming language is embedded within another.

When a form is added to a Web page that submits data to a Web application, a malicious user may exploit the MIME format to append additional information to the message being sent, such as a new list of recipients or a completely different message body. Because the MIME format uses a carriage return to delimit the information in a message, and only the raw message determines its eventual destination, adding carriage returns to submitted form data can allow a simple guestbook to be used to send thousands of messages at once. A malicious spammer could use this tactic to send large numbers of messages anonymously.^[1]

This vulnerability can potentially affect any application that sends email messages based on input from arbitrary users.

References

^ Dafydd Stuttard; Marcus Pinto (16 March 2011). The Web Application Hacker's Handbook: Discovering and Exploiting Security Flaws. John Wiley & Sons. pp. 321–324. ISBN 978-1-118-07961-4. Retrieved 11 July 2013.

External links

Email Headers Injection Using mail() Function (English)
Email Headers Injection Using mail() Function (French)

This computer networking article is a stub. You can help Wikipedia by expanding it.

[StuttardPinto2011-1] Dafydd Stuttard; Marcus Pinto (16 March 2011). The Web Application Hacker's Handbook: Discovering and Exploiting Security Flaws. John Wiley & Sons. pp. 321–324. ISBN 978-1-118-07961-4. Retrieved 11 July 2013.

[1]