The "Perl Feedback Form CGI Script" (chfeedback.pl) located at http://www.thesitewizard.com/wizards/feedbackform.shtml prior to 10/05/2005 lacked variable sanitization, and as such allowed for CRLF injection. This allowed anyone to add email fields (such as Bcc:) via a crafted URL, and send gobs of spam as a result. I notified the vendor yesterday, and although I haven't received any response yet (nor would I expect to in such a short amount of time), I noticed that the script has been updated with proper sanitization. Old version: chfeedback.pl Feedback Form Perl Script Ver 2.01 New version: chfeedback.pl Feedback Form Perl Script Ver 2.2.1 No proof of concept - I don't support giving spammers any more information than this. If you have users using this form, you can add the following 2 lines to the send_email() subroutine just before the line: if (open MAIL, "|$mailprog -t") { Update with this: $name =~ s/[\r\n].*//s; $email =~ s/[\r\n].*//s; _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/