Scans for leftover test e-mail scripts rise on SANS honeypots
- Severity
- Low
- Sources
- 1
What happened
SANS ISC notes a modest resurgence in scans against honeypots for e-mail scripts, including /sendmail.php, /test-mail.php, /testemail.php, /config/mailconfig.php, /mailconfig.php, /email-test.php and /mailtest.php, alongside requests for credential and secret files. The likely goal is abusing open relay or arbitrary To-header forms for spam, and the article cites the historic CVE-2000-0411 as an example of env-variable leakage in CGI mail scripts. No specific current CVE or affected version is given. Defenders should scan their own hosts for these paths, remove development and test artefacts from production, and block access to credential files.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check your own web servers for the test e-mail script paths listed in the report.
- Remove development and test scripts such as mailtest.php from live websites.
- Check public web servers for exposed credential and secret files.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies