Skip to content

Commit

Permalink
Say hello to my little friend
Browse files Browse the repository at this point in the history
  • Loading branch information
opsxcq committed Jan 19, 2017
1 parent 0dfc6a1 commit a4dca24
Showing 1 changed file with 17 additions and 1 deletion.
18 changes: 17 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,23 @@ Analysing the code, there is no filter in `mailSend()` function
`$this->Sender` is directly appended to `$params` variable, which was filtered in `validateAddress()` function, but as it uses RFC 3696 specification, it allow certain characters which will break things.
In this case, quotes:


> In addition to quoting using the backslash character, conventional
> double-quote characters may be used to surround strings. For example
>
> "Abc@def"@example.com
>
> "Fred Bloggs"@example.com
> are alternate forms of the first two examples above. These quoted
> forms are rarely recommended, and are uncommon in practice, but, as
> discussed above, must be supported by applications that are
> processing email addresses. In particular, the quoted forms often
> appear in the context of addresses associated with transitions from
> other systems and contexts; those transitional requirements do still
> arise and, since a system that accepts a user-provided email address
> cannot "know" whether that address is associated with a legacy
> system, the address forms must be accepted and passed into the email
> environment.
### Notes about PHP mail() function exploitation

Expand Down

0 comments on commit a4dca24

Please sign in to comment.