# Scanners probe leftover PHP mail test scripts

Published: 2026-11-04 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/a86af67b-07a3-5575-88ee-0d33921b3ae6/scanners-probe-leftover-php-mail-test-scripts
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> SANS ISC observes scans for abandoned test mail scripts (e.g. mailtest.php) that let attackers abuse open mail relay for spam.

Source: isc.sans.edu — https://isc.sans.edu/diary/rss/33488

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: A public exploit is recorded for CVE-2000-0411 (poc); no exploitation in the wild is recorded.

SANS ISC's Johannes Ullrich reports a resurgence in honeypot scans targeting e-mail-related CGI/PHP scripts, echoing old vulnerabilities like CVE-2000-0411 where additional URL parameters could leak environment variables or allow arbitrary 'To' header injection for spam. Observed scan URLs include /sendmail.php, /test-mail.php, /testemail.php, /config/mail_config.php, /mail_config.php, /email-test.php, and /mailtest.php. The 'test' naming pattern suggests attackers are hunting for development/debug scripts mistakenly left on production servers rather than exploiting a specific current CVE.

An example mailtest.php script found via Google search illustrates the risk: it accepts an arbitrary 'email' GET parameter as the mail recipient and dumps server environment variables (HTTP_HOST, SERVER_ADDR, DOCUMENT_ROOT, SCRIPT_FILENAME, etc.) into the message body, enabling both information disclosure and abuse as an open mail relay for spam. The script even contains a comment warning developers to delete it before going live, underscoring that this is a code-hygiene failure rather than a novel vulnerability.

Defenders are advised to scan their own web estates for these and similar test-script filenames, remove any debug/test mail scripts before and after deployment, and ensure CI/CD or release processes catch development artifacts that should never reach production. No specific threat actor or campaign is attributed; this is opportunistic, low-sophistication scanning activity, likely by spammers.

## Mentioned in this report

- Vulnerabilities: CVE-2000-0411 (poc)

## Detection guidance (public sample)

### Web Probing for Leftover PHP Mail Test Scripts

ATT&CK: T1595.002

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs webserver logs. Status: experimental. Generated from the report; not run against telemetry.

Non-successful requests for common mail test/config script names (mailtest.php, test-mail.php, mail_config.php and similar), a pattern seen in opportunistic scanning for forgotten debug scripts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Probing for Leftover PHP Mail Test Scripts
description: Detects web requests for well-known mail test or mail config PHP script
  names that did not return HTTP 200, indicating scanners hunting for debug scripts
  left on production servers. Matches the filename pattern, not a source IP or campaign.
tags:
- attack.reconnaissance
- attack.t1595.002
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|endswith:
    - /sendmail.php
    - /test-mail.php
    - /testemail.php
    - /config/mail_config.php
    - /mail_config.php
    - /email-test.php
    - /mailtest.php
  filter_success:
    sc-status: 200
  condition: selection and not filter_success
falsepositives:
- Applications that legitimately ship a sendmail.php handler and are requested while
  temporarily broken
- Authorised internal vulnerability scanners
level: low
id: 024b0de8-92d1-59d7-9668-c340f63637d9
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33488
```

### Successful Access to Exposed PHP Mail Test or Config Script

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs webserver logs. Status: experimental. Generated from the report; not run against telemetry.

HTTP 200 responses for mail test/config PHP scripts, meaning a debug script is live on a public web server and may leak environment data or act as a mail relay. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Successful Access to Exposed PHP Mail Test or Config Script
description: Detects HTTP 200 responses to requests for mail test or mail config PHP
  scripts such as mailtest.php or mail_config.php. A successful response means a development
  or debug script is reachable in production, enabling environment variable disclosure,
  config exposure, or open mail relay abuse.
tags:
- attack.initial-access
- attack.t1190
- attack.credential-access
- attack.t1552.001
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|endswith:
    - /test-mail.php
    - /testemail.php
    - /config/mail_config.php
    - /mail_config.php
    - /email-test.php
    - /mailtest.php
    sc-status: 200
  condition: selection
falsepositives:
- Intentionally exposed mail test page on a staging or development server that is
  logged by the same collector
- Authorised vulnerability scans that find the script
level: medium
id: 4766e0f7-8c29-5815-8fab-5c218ae9768a
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33488
```

### Mail Test Script Called With Recipient Parameter

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs webserver logs. Status: experimental. Generated from the report; not run against telemetry.

Requests to mail test/send scripts carrying a recipient email address in the query string, suggesting abuse as a mail relay or header injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Mail Test Script Called With Recipient Parameter
description: Detects requests to mail test or sendmail PHP scripts whose query string
  supplies a recipient address (email, to, recipient parameter containing an @ or
  encoded @). This indicates attempted abuse of a leftover test script as an open
  mail relay or To-header injection, as with the mailtest.php example that accepts
  an arbitrary email GET parameter.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|endswith:
    - /sendmail.php
    - /test-mail.php
    - /testemail.php
    - /email-test.php
    - /mailtest.php
  selection_param:
    cs-uri-query|contains:
    - email=
    - to=
    - recipient=
  selection_addr:
    cs-uri-query|contains:
    - '@'
    - '%40'
  condition: selection_path and selection_param and selection_addr
falsepositives:
- Developers legitimately testing a mail script on an internet-facing staging server
- Contact-form handlers named sendmail.php that take the sender address as a parameter
level: medium
id: 0efd5bc8-c3a6-5511-89f0-c00c4a1aff4f
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33488
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33488

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a86af67b-07a3-5575-88ee-0d33921b3ae6/scanners-probe-leftover-php-mail-test-scripts.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup