thesitewizard.com chfeedback.pl CRLF Injection

[deathtrip <deathtrip () gmail com>]

The "Perl Feedback Form CGI Script" (chfeedback.pl) located at
http://www.thesitewizard.com/wizards/feedbackform.shtml prior to
10/05/2005 lacked variable sanitization, and as such allowed for CRLF
injection. This allowed anyone to add email fields (such as Bcc:) via
a crafted URL, and send gobs of spam as a result. I notified the
vendor yesterday, and although I haven't received any response yet
(nor would I expect to in such a short amount of time), I noticed that
the script has been updated with proper sanitization.

Old version: chfeedback.pl Feedback Form Perl Script Ver 2.01
New version: chfeedback.pl Feedback Form Perl Script Ver 2.2.1

No proof of concept - I don't support giving spammers any more
information than this.

If you have users using this form, you can add the following 2 lines
to the send_email() subroutine just before the line:

        if (open MAIL, "|$mailprog -t") {


Update with this:

        $name   =~ s/[\r\n].*//s;
        $email  =~ s/[\r\n].*//s;
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/