The Perl Feedback Form CGI script (chfeedback.pl) lacks variable sanitizing and allows for CRLF injection, enabling addition of email fields.
ba0e2e8aa5b9b43e47fa4c87827fc0d62e1ff23f8d229fe2547644e85631c78b
The "Perl Feedback Form CGI Script" (chfeedback.pl) located at
http://www.thesitewizard.com/wizards/feedbackform.shtml prior to
10/05/2005 lacked variable sanitization, and as such allowed for CRLF
injection. This allowed anyone to add email fields (such as Bcc:) via
a crafted URL, and send gobs of spam as a result. I notified the
vendor yesterday, and although I haven't received any response yet
(nor would I expect to in such a short amount of time), I noticed that
the script has been updated with proper sanitization.
Old version: chfeedback.pl Feedback Form Perl Script Ver 2.01
New version: chfeedback.pl Feedback Form Perl Script Ver 2.2.1
No proof of concept - I don't support giving spammers any more
information than this.
If you have users using this form, you can add the following 2 lines
to the send_email() subroutine just before the line:
if (open MAIL, "|$mailprog -t") {
Update with this:
$name =~ s/[\r\n].*//s;
$email =~ s/[\r\n].*//s;