Scanners probe leftover PHP mail test scripts
SANS ISC observes scans for abandoned test mail scripts (e.g. mailtest.php) that let attackers abuse open mail relay for spam.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2000-0411 (poc); no exploitation in the wild is recorded.
SANS ISC's Johannes Ullrich reports a resurgence in honeypot scans targeting e-mail-related CGI/PHP scripts, echoing old vulnerabilities like CVE-2000-0411 where additional URL parameters could leak environment variables or allow arbitrary 'To' header injection for spam. Observed scan URLs include /sendmail.php, /test-mail.php, /testemail.php, /config/mail_config.php, /mail_config.php, /email-test.php, and /mailtest.php. The 'test' naming pattern suggests attackers are hunting for development/debug scripts mistakenly left on production servers rather than exploiting a specific current CVE.
An example mailtest.php script found via Google search illustrates the risk: it accepts an arbitrary 'email' GET parameter as the mail recipient and dumps server environment variables (HTTP_HOST, SERVER_ADDR, DOCUMENT_ROOT, SCRIPT_FILENAME, etc.) into the message body, enabling both information disclosure and abuse as an open mail relay for spam. The script even contains a comment warning developers to delete it before going live, underscoring that this is a code-hygiene failure rather than a novel vulnerability.
Defenders are advised to scan their own web estates for these and similar test-script filenames, remove any debug/test mail scripts before and after deployment, and ensure CI/CD or release processes catch development artifacts that should never reach production. No specific threat actor or campaign is attributed; this is opportunistic, low-sophistication scanning activity, likely by spammers.
Mentioned in this report
Detection guidance
Web Probing for Leftover PHP Mail Test Scripts
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Non-successful requests for common mail test/config script names (mailtest.php, test-mail.php, mail_config.php and similar), a pattern seen in opportunistic scanning for forgotten debug scripts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Probing for Leftover PHP Mail Test Scripts
description: Detects web requests for well-known mail test or mail config PHP script
names that did not return HTTP 200, indicating scanners hunting for debug scripts
left on production servers. Matches the filename pattern, not a source IP or campaign.
tags:
- attack.reconnaissance
- attack.t1595.002
logsource:
category: webserver
detection:
selection:
cs-uri-stem|endswith:
- /sendmail.php
- /test-mail.php
- /testemail.php
- /config/mail_config.php
- /mail_config.php
- /email-test.php
- /mailtest.php
filter_success:
sc-status: 200
condition: selection and not filter_success
falsepositives:
- Applications that legitimately ship a sendmail.php handler and are requested while
temporarily broken
- Authorised internal vulnerability scanners
level: low
id: 024b0de8-92d1-59d7-9668-c340f63637d9
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33488
Successful Access to Exposed PHP Mail Test or Config Script
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
HTTP 200 responses for mail test/config PHP scripts, meaning a debug script is live on a public web server and may leak environment data or act as a mail relay. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Successful Access to Exposed PHP Mail Test or Config Script
description: Detects HTTP 200 responses to requests for mail test or mail config PHP
scripts such as mailtest.php or mail_config.php. A successful response means a development
or debug script is reachable in production, enabling environment variable disclosure,
config exposure, or open mail relay abuse.
tags:
- attack.initial-access
- attack.t1190
- attack.credential-access
- attack.t1552.001
logsource:
category: webserver
detection:
selection:
cs-uri-stem|endswith:
- /test-mail.php
- /testemail.php
- /config/mail_config.php
- /mail_config.php
- /email-test.php
- /mailtest.php
sc-status: 200
condition: selection
falsepositives:
- Intentionally exposed mail test page on a staging or development server that is
logged by the same collector
- Authorised vulnerability scans that find the script
level: medium
id: 4766e0f7-8c29-5815-8fab-5c218ae9768a
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33488
Mail Test Script Called With Recipient Parameter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Requests to mail test/send scripts carrying a recipient email address in the query string, suggesting abuse as a mail relay or header injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Mail Test Script Called With Recipient Parameter
description: Detects requests to mail test or sendmail PHP scripts whose query string
supplies a recipient address (email, to, recipient parameter containing an @ or
encoded @). This indicates attempted abuse of a leftover test script as an open
mail relay or To-header injection, as with the mailtest.php example that accepts
an arbitrary email GET parameter.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|endswith:
- /sendmail.php
- /test-mail.php
- /testemail.php
- /email-test.php
- /mailtest.php
selection_param:
cs-uri-query|contains:
- email=
- to=
- recipient=
selection_addr:
cs-uri-query|contains:
- '@'
- '%40'
condition: selection_path and selection_param and selection_addr
falsepositives:
- Developers legitimately testing a mail script on an internet-facing staging server
- Contact-form handlers named sendmail.php that take the sender address as a parameter
level: medium
id: 0efd5bc8-c3a6-5511-89f0-c00c4a1aff4f
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33488
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33488
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs