Re: [cobalt-users] Dodgy formmail.pl?

[Parker Morse <morse@xxxxxxxxxxx>]

On Wednesday, January 8, 2003, at 07:54  AM, Dan Kriwitsky wrote:
> Are you sure the email address isn't specified in the form someplace so
> that it can't be abused?

I'm sure Dan meant to say, the email address should be specified in the 
SCRIPT someplace so that it can't be abused. If the address is specified 
in the form, say as a value in a hidden field, an abuser could simply 
change that address in their http request, right?

Judging from the posted script:

> # 3) If you are using this CGI for multiple users you can specify who
> #    the message should be sent to by adding a
> #                <input type=hidden name="to"
> value="your-email@xxxxxxxxxxx">
> #                <input type=hidden name="redir"
> value="http://www.thankspageURL";>
> #

...that does look pretty insecure to me, yes, unless the script itself has 
been rewritten specifically to ignore the "to" value handed in from the 
http request and use only its hardwired default.

pjm