Email injection

From Wikipedia, the free encyclopedia

Email injection is a security vulnerability that can occur in internet applications that are used to send email messages. Like SQL injection attacks, this vulnerability is a general class of vulnerabilities that occur when one programming language is embedded within another.

When a form is added to a webpage that submits data to a web application, a malicious user can potentially exploit the MIME format to append additional information to the message being sent, such as a new list of recipients or a completely different message body. Because the MIME format uses a carriage return to delimit the information in a message, and only the raw message determines its eventual destination, adding Carriage Returns to submitted form data can allow a simple guestbook to be used to send thousands of messages at once. A malicious spammer could use this tactic to send large amounts of messages anonymously.

More information on this topic, including examples and ways to avoid the vulerability, can be found at the SecurePHP Wiki. However, this is vulerability is not limited to PHP: it can potentially affect any application that accepts public user-input and sends email messages.