-3

how an attacker can exploit the below provided feedback form in a company website containing the company’s domain? the feedback form does not store data into a database. The server side code only mails the administrator. plz Do not include DOS attacks.

Code for the above form:

<form action="serverUrl" method="POST"> Your name: <br> <input type="text" name="realname"><br> <br> Your email: <br> <input type="text" name="email"><br> <br> Your comments: <br> <textarea name="comments" rows="15" cols="50"></textarea><br><br> <input type="submit" value="Submit"> </form>

closed as too broad by Xander, Mark, Gilles, TildalWave, schroeder Sep 30 '14 at 1:11

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

6

Posting a body such as this:

realname%3DSisodiya%20Chhatrapalsinh%26email%3D%60rm%20-rf%20%2F%60%26comments%3DDo%20your%20own%20homework%26submit%3DSubmit
  • But how exactly will it work? what will it do? – Chhatrapal Sisodiya Sep 29 '14 at 19:32
  • I s'pose it's really just as well that you did not include the "shellshock" string in the email address. – Bob Brown Sep 29 '14 at 23:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.