RE: Tracking down bad php formmail scripts

James Smallacombe wrote:
> Hi:
> 
> For the second time in as many days, my root account has been
> bombarded with rejection notices for spam that's originating on our
> server.  It's not being relayed via SMTP, it's apparently being
> injected directly into the MTA by the localhost.
> 
> I've seen this in the past with various perl cgi's, but those could be
> tracked down by looking at the apache cgi or suexec logs.  In this
> case, it must be coming from a client's php script as it shows uid 80
> (httpd) as the invoker of qmail.
> 
> The question is, how do you track down which virtual host on your
> server has the offending code, let alone the code itself?  I can see
> no further clues in the headers or global httpd error log.


Works like a charm:

http://www.lancs.ac.uk/~steveb/patches/php-mail-header-patch/

Andrew

-- 
Eat sushi frequently. - Avi
[email protected] is the human contact address.
[email protected] is the list posting address.
See below URL for subscribe/unsubscribe and list options:
http://inet-access.net/mailman/listinfo/list