2b:T7bd,Gry Hat 015 Securitykaizen Magazine GREY HAT Email Injection Ahmed Mohamed Is an information security professional and author. He focuses mainly in the areas of exploitation,reverse engineering and web security. He is a trainee at RayaCorp. as Information Security engineer , He’s the webmaster of www.ITsec4all. com Email injection is a type of injection attack that hits the PHP built-in mail function, which allows the malicious attacker to inject any type of mail header fields like (BBC, CC, Subject, ...etc) , allowing the spammer to send out spam from your mail form, this attack is called (Email Injection or mail form spamming) www.bluekaizen.org T he main reason for the success of this attack is improper user input validation or that there is no validation and filtration at all. Let’s have a look at the php mail function description from the php manual: “bool mail ( string $to , string $subject , string $message [, string $additional_headers [, string $additional_parameters ]] )” As you notice it takes three mandatory parameters (“to , subject and message”) and some other optional parameters and the function returns a bool (True or False). So let’s have a look at a vulnerable code to demonstrate this vulnerability: 2c:Tc46,