How can Spammers abuse my apache sendmail?

[mefromspace]

Originally Posted by Zachery

There is no such code in the default product.

You referring to me or? what code u referring to?

--------------- Added [DATE]1379446734[/DATE] at [TIME]1379446734[/TIME] ---------------

Originally Posted by nhawk

There are two places for each usergroup where email can be sent.

1) Can Use Email to a Friend
2) Can Email Members

Be sure both of those are turned off for these usergroups..

Unregistered/Not Logged In
Users Awaiting Email Confirmation
Users Awaiting Confirmation

and optionally..
Registered Users
Any other usergroups you want to turn it off for.

As per: https://vborg.vbsupport.ru/showpost....17&postcount=6

I already triple checked this

[nhawk]

I'm pretty sure Zachery was saying there is no code in register.php where email (or the code to send email) can be injected.

And personally I think the techs at your host are making a bad assumption. They are probably seeing a ton of these in your logs..

POST /register.php?do=checkdate
POST /register.php?do=addmember

That is not an injection taking place. That is a bot trying to gain access to your site by guessing at the human verification or whatever other verification scheme you're using.

[mefromspace]

Originally Posted by nhawk

I'm pretty sure Zachery was saying there is no code in register.php where email (or the code to send email) can be injected.

And personally I think the techs at your host are making a bad assumption. They are probably seeing a ton of these in your logs..

POST /register.php?do=checkdate
POST /register.php?do=addmember

That is not an injection taking place. That is a bot trying to gain access to your site by guessing at the human verification or whatever other verification scheme you're using.

ahhh gotcha now i understand what hes referring to

I submitted the server logs from the host and a ticket at vb so time will tell what they get back with of info.