Spam via sendmessage.php?

محروم.كوم · #1 05-05-2009, 02:20 AM

Not sure if this is just a clever spoof, a bug, or a security issue. But, it looks like someone is able to send spam from my install of vB (via the sendmessage.php). I have been getting one or two the following bounced emails every day for a week or so. (I cleaned it of site, domain, and server names).

Quote:
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

[email protected]
SMTP error from remote mail server after RCPT TO::
host bcgsa.com [206.130.110.179]: 550 5.1.1 ... User unknown

------ This is a copy of the message, including all the headers. ------

Return-path:
Received: from SERVERNAME ([127.0.0.1] helo=localhost)
by DOMAINNAME with esmtp (Exim 4.63)
(envelope-from )
id 1M132x-0000od-U4
for [email protected]; Mon, 04 May 2009 13:37:55 -0500
Date: Mon, 04 May 2009 18:37:47 +0000
To: [email protected]
From: "SITENAME"
Auto-Submitted: auto-generated
Message-ID:
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-Mailer: vBulletin Mail via PHP
X-EZbouncer: http://www.DOMAINNAME/admincp/ezbounce.php?u=
Subject: [email protected]
X-Spam-Report: Spam detection software, running on the system "SERVERNAME.DOMAINNAME", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Della Riley, This is a message from Kayla Trujillo ( mailto:
) from the SITENAME ( http://www.DOMAINNAME/ ). The message is as follows:
[...]
Content analysis details: (-0.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-1.4 ALL_TRUSTED Passed through trusted hosts only via SMTP
2.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence
-1.3 AWL AWL: From: address is in the auto white-list

Della Riley,

This is a message from Kayla Trujillo ( mailto: ) from the SITENAME ( http://www.DOMAINNAME/ ).

The message is as follows:

38jkwskkr2m1lzdb
tplnh mzfv
http://wjcwhrvwwdtz.com

msxhfpz idyfjga
http://cwzyvgtldb.com

SITENAME takes no responsibility for messages sent through its system.
The usernames (Della Riley and Kayla Trujillo) do not exist (in my user table), nor does the email address: [email protected].

I notice the ( mailto: ) is blank and the userid is missing from: /admincp/ezbounce.php?u=

Thanks for any assistance or insight.

--RayJ __DEFINE_LIKE_SHARE__

المواضيع المتشابهه
الموضوع	كاتب الموضوع	المنتدى	مشاركات	آخر مشاركة
Spam Tools including AKISMET A simple anti-spam idea which works 100%	محروم.كوم	منتدى أخبار المواقع والمنتديات العربية والأجنبية	0	01-10-2010 12:30 PM
RSS spam prevention - delay for new posters to prevent pushing spam? Other ideas?	محروم.كوم	منتدى أخبار المواقع والمنتديات العربية والأجنبية	0	11-04-2009 07:50 AM
اريد تغير الايميل بملف sendmessage.php	محروم.كوم	منتدى أخبار المواقع والمنتديات العربية والأجنبية	0	09-14-2009 11:00 PM
Spam Tools including AKISMET vBulletin Anti-Spam Check Service	محروم.كوم	منتدى أخبار المواقع والمنتديات العربية والأجنبية	0	08-14-2009 02:20 AM
Spam Tools including AKISMET vBulletin Anti-Spam Check Service	محروم.كوم	منتدى أخبار المواقع والمنتديات العربية والأجنبية	0	08-14-2009 02:10 AM