ESMB is back. Again.
- Thread starter ethercat
- Start date
Magoo
Gold Meritorious Patron
<<<<I Love this.
View attachment 6541 (Had to try it
Sooooooooooooo great to be back in touch w/ you all.
I missed you!
Tory/Magoo
suspiciousperson
Patron with Honors
You don't have register globals* turned on do you by any chance? That would be one other way they could alter the flow of the script and remove your to, depending upon quite how badly the script is written, e.g. if it's something like
On normal php setups spammers couldn't exploit this bug because register globals is almost always turned off these days. But it doesn't have to be, particularly if you are using an old php.ini or one you setup to let a very old script run that relied on register globals.
*an infamously stupid "helpful" technology, pretty archaic by now and I think actually entirely removed from the latest versions of php but I dunno what server setup you're running
PHP:
/* $to set to your wanted value up here somewhere */
if($debug){ //$debug not initialised anywhere in script so $debug should always == (but not ===) false. However, spammers need to do is stick a &debug=true into the request querystring or post data, and I think even possibly cookies as well, and bobs yer uncle, if register globals is on
$to = $_POST['to']
}
/* sends email here */On normal php setups spammers couldn't exploit this bug because register globals is almost always turned off these days. But it doesn't have to be, particularly if you are using an old php.ini or one you setup to let a very old script run that relied on register globals.
*an infamously stupid "helpful" technology, pretty archaic by now and I think actually entirely removed from the latest versions of php but I dunno what server setup you're running
suspiciousperson
Patron with Honors
p.s. feel free to pm me the script, I'm pretty sure I can fix the problem.
afaceinthecrowd
Gold Meritorious Patron
Many Thanks!
JustSheila
Crusader
Ethercat...
You are Legend. Thanks.
You are Legend. Thanks.
Red Valiant
Patron with Honors
You are genuine as well!
ethercat
Cat in flight
No, register_globals was/is disabled, and marked as deprecated.
Royal Prince Xenu
Trust the Psi Corps.
I must have missed all the fun. I guess real life is starting to get in the way ...
sallydannce
Gold Meritorious Patron
Been meaning to contact you about your ESMB stats...they suck! :wink2:
Please try to stay focused and post more!
