Security hole in unpatched v7 "Contact us" form?

[Arbre]

Hi there,

We're still running Actinic v7, (*) and this morning we realised that someone had been using our site's Actinic "Contact Us" form to send out spam (i.e. the messages were sent to other people).

Is there an issue with an unpatched version 7.0.6.0.0.0.GBGA that could cause abuse of the form this way? The fact that we also received copies of all the spam ourselves implies that the other people's addresses were injected before/after our pre-existing "To:" header.

Also, I've disabled the form entirely at present via the quick-and-dirty method of inserting "die()" into "mail_form.pl", but where is the option to disable this functionality in Actinic itself?

Would appreciate any feedback, thank you.

- Arbre

(*) Yes, I realise it's long obsolete and probably not patched. Unfortunately, the system has been heavily customised, which makes it hard to patch or upgrade- so we do not blame Actinic/SellerDeck for this!- and it will soon be replaced entirely.

(**) We know it's the default "Contact Us" form because- following a reference to NETQUOTEVAR:NAMEVALUE and NETQUOTEVAR:SUBJECTVALUE in one email, we went through the web logs and spotted multiple successive references to "mail_form.html" then "mf000003.pl".

[Duncan Rounding]

There are a number of things that you can do that may help.
Use the Google search box above and search for 'contact us spam v7'

[Arbre]

Thanks for your feedback.

In my defence, I *had* already tried a similar search. However, since I wasn't aware that the Actinic Desktop community had moved to sellerdeck.com at that point (or even that it had rebranded, for that matter!), I had restricted my query to "site:actinic.com" in Google.

I suppose it should have occurred to me to retry the query at the new site once I knew, but I was rather busy and it didn't.

Anyway, I'll take a look at that. All the best,

- Arbre

[cbarling]

There is definitely a problem wiith unpatched versions of v7 to do with email spamming.

There is a fix you can apply manually to v7 and all subsequent releases have the fix inbuilt.

Chrs

[PaulKelly]

Hi there,

We're still running Actinic v7, (*) and this morning we realised that someone had been using our site's Actinic "Contact Us" form to send out spam (i.e. the messages were sent to other people).

Is there an issue with an unpatched version 7.0.6.0.0.0.GBGA that could cause abuse of the form this way? The fact that we also received copies of all the spam ourselves implies that the other people's addresses were injected before/after our pre-existing "To:" header.

Also, I've disabled the form entirely at present via the quick-and-dirty method of inserting "die()" into "mail_form.pl", but where is the option to disable this functionality in Actinic itself?

Would appreciate any feedback, thank you.

- Arbre

(*) Yes, I realise it's long obsolete and probably not patched. Unfortunately, the system has been heavily customised, which makes it hard to patch or upgrade- so we do not blame Actinic/SellerDeck for this!- and it will soon be replaced entirely.

(**) We know it's the default "Contact Us" form because- following a reference to NETQUOTEVAR:NAMEVALUE and NETQUOTEVAR:SUBJECTVALUE in one email, we went through the web logs and spotted multiple successive references to "mail_form.html" then "mf000003.pl".

Steven, check out my post of June 2011
community.sellerdeck.com/showthread.php?t=50487
Then look at my website www.sportique.co.uk We are running V7 and had the same problem, since applying this solution we have not had any issues.

Paul kelly

[Arbre]

Hi there,

Thanks for the additional feedback. We'd already been able to solve the problem by simply (in effect) killing off the script with a die() near the start; not elegant, and we wanted to check a better way of doing it. But it solved the problem in the first instance, and since we don't use that form, we've left it that way.

Of course, I now appreciate that there was quite a lot of information out there on this issue, but as I mentioned, I'd missed that despite searching Google because I hadn't realised the site had moved and restricted my search to "site:community.actinic.com". (Which previously had been the best way of avoiding false positives.)

All the best,

- Arbre