SANS reports scans targeting vulnerable web email scripts

SANS Internet Storm Center researcher Johannes Ullrich reported a slight increase in scans for e-mail-related scripts on honeypots. The requests included paths such as `/sendmail.php`, `/test-mail.php`, `/email-test.php` and `/mailtest.php`. Ullrich said the activity may be spammers searching for web forms that let users choose any recipient, but noted that it is difficult to link the scans to a specific vulnerability. The word “test” in several filenames suggests that abandoned development scripts may be among the targets.

Ullrich connected the activity to older flaws in web-based e-mail scripts, including CVE-2000-0411, which could expose server environment variables when extra parameters were added to a URL. Other weaknesses allowed attackers to set the recipient address, while scripts that passed parameters directly to `sendmail` could potentially enable arbitrary code execution.

As an example, Ullrich cited a publicly accessible `mailtest.php` script that accepted a recipient through the `email` URL parameter and included server configuration details in its message. He recommended removing development artefacts before deployment and said scanning an organisation’s own hosts for such paths can provide an additional check.