PHPMailer Exploit – Remote Code Execution

Re:PHPMailer Exploit – Remote Code Execution by jackweirdy on Wednesday December 28, 2016 @04:52AM (#13269558)

That seems like a strange place to verify that a user is only allowed to create one account. After all, they could just create a second email account on a free email provider and use that to sign up.

To get around that, the service provider would have to verify identity further down the line, making the email format restriction redundant.

[ Parent | on HN ]

Re:PHPMailer Exploit – Remote Code Execution by danieltillett on Wednesday December 28, 2016 @05:12AM (#13269619)

I have been down this route and you also have to disable the use of free email accounts.

If the service value is not too high then even making people who want to abuse the service go through the process of registering a free email account works. Put a little bit of friction into the process and the script kiddies move onto an easier target.

[ Parent | on HN ]

Re:PHPMailer Exploit – Remote Code Execution by iopq on Wednesday December 28, 2016 @07:24AM (#13270049)

> I have been down this route and you also have to disable the use of free email accounts.

I don't have any other email. Seems like a really bad idea.

[ Parent | on HN ]

Re:PHPMailer Exploit – Remote Code Execution by danieltillett on Thursday December 29, 2016 @04:59AM (#13276531)

It depends on the service. Some services are only aimed at business which have their own domain, but yes I agree this is a pretty drastic step to take.

[ Parent | on HN ]