RE: [cobalt-users] Possible spammer or what?

["Dan Kriwitsky" <webhosting@xxxxxxxxx>]

> > > Yes, we have a few, with the refers set to only allow from our domain.
> >>
> >
> >Doesn't matter.
> >See
> >http://www.securiteam.com/exploits/FormMail_discloses_environment
> _variables_
> >information.html
>
> Dan,
>
> You miss one of the more important reasons for removing formmail.pl -
>
> It's actually worse than simply revealing environment variables -
> imho - at least with only a few vars someone needs to know WHAT
> to do with them - we found a client site with formmail.pl (v1.6 -
> courtesy of Matt Wright) on one of our servers - the script had
> been exploited to send about 5,000 homosexually explicit porn
> adverts out of the server PER DAY for about a week - we didn't
> notice for a while, as they were pretty careful to send only 5,000 a day!

That's the point of the URL I posted. Notice where it says <message> in the
exploit?

--
Dan Kriwitsky