Increased Scanning for Vulnerable Legacy E-Mail Test Scripts (formail/mailtest.php variants, CVE-2000-0411 lineage)

Key facts for Legacy mail test scripts

Detection coverage for Legacy mail test scripts

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5239 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Legacy E-Mail Test Script Probing, FormMail Parameter Abuse and Header Injection — Exploitation (SPL)

Splunk SPL variant of the TL-2026-5239 exploitation detection: finds web requests for leftover development/test e-mail scripts (/sendmail.php, /test-mail.php, /testemail.php, /mailtest.php, /email-test.php, /mail_config.php, /config/mail_config.php, formmail.pl) and exploit parameters reported by SANS ISC: env_report= (CVE-2000-0411 environment disclosure), attacker-controlled recipient/email/to with send=true (CVE-2001-0357 and the public PHP mail test gist pattern) and CRLF CC/BCC/TO injection (CVE-2002-1771). Aggregated per client so wordlist scanning (many distinct paths, T1595.003) stands out from a single legitimate form hit; a 200 on mail_config.php escalates risk because it may expose SMTP settings (T1552.001).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1595.003, T1595.002, T1592.002, T1190, T1552.001, T1082
• Data sources: web_access_logs, splunk:index=web sourcetype=access_combined, iis_w3c_logs
• Severity: medium
• Confidence: high

Splunk SPL

index=web sourcetype=access_combined earliest=-24h (method=GET OR method=POST)
| eval path=lower(urldecode(uri_path)), rawqs=lower(coalesce(uri_query,"")), qs=urldecode(rawqs)
| eval probe_path=if(match(path,"(sendmail|mailtest|test-mail|testemail|email-test|mail_config)[.]php$") OR match(path,"/formmail([.](pl|cgi|php))?$"),1,0)
| eval env_report=if(match(qs,"(^|&)env_report="),1,0)
| eval rcpt_abuse=if(match(qs,"(^|&)(email|recipient|to)=[^&]*@") AND match(qs,"(^|&)send=true"),1,0)
| eval hdr_inject=if(match(rawqs,"%0[ad](%20|\+)*(cc|bcc|to)(%3a|:)"),1,0)
| eval cfg_exposed=if(match(path,"mail_config[.]php$") AND status=200,1,0)
| where probe_path=1 OR env_report=1 OR rcpt_abuse=1 OR hdr_inject=1
| stats count AS hits dc(path) AS distinct_paths values(path) AS paths values(status) AS statuses sum(env_report) AS env_report_hits sum(rcpt_abuse) AS recipient_abuse_hits sum(hdr_inject) AS header_injection_hits sum(cfg_exposed) AS config_200_hits min(_time) AS first_seen max(_time) AS last_seen by clientip
| eval risk=if(distinct_paths>=3 OR env_report_hits+recipient_abuse_hits+header_injection_hits+config_200_hits>=1,"high","medium")
| sort - distinct_paths

Microsoft KQL

W3CIISLog
| where TimeGenerated > ago(24h)
| extend Path = tolower(url_decode(csUriStem)), RawQs = tolower(tostring(csUriQuery))
| extend Qs = url_decode(RawQs)
| extend ProbePath = Path matches regex @"(sendmail|mailtest|test-mail|testemail|email-test|mail_config)\.php$" or Path matches regex @"/formmail(\.(pl|cgi|php))?$"
| extend EnvReport = Qs matches regex @"(^|&)env_report="
| extend RcptAbuse = Qs matches regex @"(^|&)(email|recipient|to)=[^&]*@" and Qs matches regex @"(^|&)send=true"
| extend HdrInject = RawQs matches regex @"%0[ad](%20|\+)*(cc|bcc|to)(%3a|:)"
| extend CfgExposed = Path matches regex @"mail_config\.php$" and tostring(scStatus) == "200"
| where ProbePath or EnvReport or RcptAbuse or HdrInject
| summarize Hits = count(), DistinctPaths = dcount(Path), Paths = make_set(Path, 20), Statuses = make_set(scStatus, 10), EnvReportHits = countif(EnvReport), RecipientAbuseHits = countif(RcptAbuse), HeaderInjectionHits = countif(HdrInject), Config200Hits = countif(CfgExposed), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by cIP, sSiteName
| extend Risk = iff(DistinctPaths >= 3 or EnvReportHits + RecipientAbuseHits + HeaderInjectionHits + Config200Hits >= 1, "high", "medium")
| project FirstSeen, LastSeen, cIP, sSiteName, Hits, DistinctPaths, EnvReportHits, RecipientAbuseHits, HeaderInjectionHits, Config200Hits, Paths, Statuses, Risk
| order by DistinctPaths desc

Sigma

title: Leftover E-Mail Test Script Probing, FormMail Parameter Abuse or Header Injection
id: a1f4c2d8-5239-4a1b-8e3c-0b7d9e1f2a01
status: experimental
description: Detects web requests for leftover development/test e-mail scripts (sendmail.php, mailtest.php, test-mail.php, testemail.php, email-test.php, mail_config.php, formmail), the CVE-2000-0411 env_report parameter, attacker-controlled recipient parameters (CVE-2001-0357) and CRLF CC/BCC/TO header injection (CVE-2002-1771), as observed by SANS ISC honeypots (TL-2026-5239).
references:
    - https://isc.sans.edu/diary/33488
    - https://nvd.nist.gov/vuln/detail/cve-2000-0411
    - https://nvd.nist.gov/vuln/detail/cve-2001-0357
    - https://nvd.nist.gov/vuln/detail/cve-2002-1771
    - https://gist.github.com/Porrapat/60ed7411d933122fc481
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.reconnaissance
    - attack.t1595.003
    - attack.t1595.002
    - attack.t1592.002
    - attack.initial-access
    - attack.t1190
    - attack.credential-access
    - attack.t1552.001
    - attack.discovery
    - attack.t1082
    - cve.2000-0411
    - cve.2001-0357
    - cve.2002-1771
logsource:
    category: webserver
detection:
    selection_path:
        c-uri|contains:
            - '/sendmail.php'
            - '/test-mail.php'
            - '/testemail.php'
            - '/mailtest.php'
            - '/email-test.php'
            - '/mail_config.php'
    selection_formmail:
        c-uri|contains: '/formmail.'
    selection_envreport:
        cs-uri-query|contains: 'env_report='
    selection_rcpt_key:
        cs-uri-query|contains:
            - 'email='
            - 'recipient='
            - 'to='
    selection_rcpt_send:
        cs-uri-query|contains|all:
            - 'send=true'
            - '@'
    selection_hdr_inject:
        cs-uri-query|re: '(?i)%0[ad](%20|\+)*(cc|bcc|to)(%3a|:)'
    condition: selection_path or selection_formmail or selection_envreport or selection_hdr_inject or (selection_rcpt_key and selection_rcpt_send)
falsepositives:
    - Authorized vulnerability scanners and external attack-surface assessments
    - Legitimate contact forms that happen to use one of the listed filenames
level: medium

Known false positives:

• Authorized vulnerability scanners and external attack-surface management tools requesting the same paths
• A legitimate production contact form that uses one of the listed filenames (for example /sendmail.php) and posts the recipient server-side
• Developers or QA testing a staging mail script from a known source address

Tuning notes: Change index/sourcetype to match your web log onboarding (nginx:plus:access, iis, etc.). Exclude known scanner and monitoring source IPs with a lookup and raise the distinct_paths threshold on very noisy internet-facing sites. Any env_report, header-injection or recipient-abuse hit, or a 200 response to mail_config.php, deserves immediate triage; also delete the scripts themselves. TL_OSINT_Scan shows no community-corroborated IOCs or sibling infrastructure for this threat yet, so the logic is path/parameter based rather than IP based.

• 🔒 Legacy E-Mail Test Script Probing, FormMail Parameter Abuse and Header Injection — Exploitation (KQL) · unlock with TL Creds
• 🔒 Web Server Worker Spawning Sendmail With Injection Arguments, Shell/Discovery Utilities or Mail Config Reads — Post-Exploitation (KQL) · unlock with TL Creds
• 🔒 Web Server Process Initiating Outbound SMTP — Spam Relay and Mail-Based Data Egress — C2 / Egress (KQL) · unlock with TL Creds
• 🔒 Legacy E-Mail Test Script Probing, FormMail Parameter Abuse and Header Injection — Exploitation (Sigma) · unlock with TL Creds
• 🔒 Web Server Worker Spawning Sendmail With Injection Arguments, Shell/Discovery Utilities or Mail Config Reads — Post-Exploitation (Sigma) · unlock with TL Creds
• 🔒 Web Server Process Initiating Outbound SMTP — Spam Relay and Mail-Based Data Egress — C2 / Egress (Sigma) · unlock with TL Creds
• 🔒 Web Server Worker Spawning Sendmail With Injection Arguments, Shell/Discovery Utilities or Mail Config Reads — Post-Exploitation (SPL) · unlock with TL Creds
• 🔒 Web Server Process Initiating Outbound SMTP — Spam Relay and Mail-Based Data Egress — C2 / Egress (SPL) · unlock with TL Creds

Indicators of compromise for Legacy mail test scripts

As of 2026-11-04, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5239.

Sample indicators (1 of 10)

• URL: hxxps://gist[.]github[.]com/Porrapat/60ed7411d933122fc481

Defanged, TLP:CLEAR. Full set of 10 indicators: unlock with TL Creds.

How Legacy mail test scripts works

On 2026-11-04 Johannes Ullrich of the SANS Internet Storm Center reported (diary 33488, 'The Classics Return: Vulnerable E-Mail Scripts') that honeypots are receiving increased requests for development and test e-mail scripts that were left on production web servers. The observed request paths are /sendmail.php, /test-mail.php, /testemail.php, /config/mail_config.php, /mail_config.php, /email-test.php and /mailtest.php. The word 'test' in most filenames indicates that the scanners are hunting for leftover debugging utilities rather than legitimate production mail handlers. The ISC assesses the likely goal as locating web forms that let the requester set the e-mail recipient, so the host can be used to distribute spam.

The diary draws a line to CVE-2000-0411, a 2000-era flaw in Matt Wright's FormMail CGI script (version 1.6) where the env_report parameter lets a remote attacker obtain server environment variables. The same script family was also abused to send anonymous spam by modifying the recipient and message parameters (CVE-2001-0357, FormMail 1.6 and earlier) and via newline injection of CC:/BCC:/TO: fields in the email and realname variables (CVE-2002-1771, FormMail 1.9 and earlier). The ISC notes three failure modes in this class of script: URL parameters that leak server environment variables, arbitrary 'To' addresses that turn the host into a spam relay, and parameters passed directly to the sendmail binary that can lead to remote code execution.

A public example of the modern pattern is a quick-and-dirty PHP mail test script (GitHub gist Porrapat/60ed7411d933122fc481). It takes the recipient from a GET parameter ('email'), sends only when 'send=true' is present, calls PHP mail() with a body containing HTTP_HOST, SERVER_NAME, REMOTE_ADDR and SCRIPT_FILENAME, and carries the comment 'DONT FORGET TO DELETE THIS SCRIPT WHEN FINISHED!'. Any such script left reachable without authentication gives an unauthenticated visitor a mail relay and a small server-information disclosure. A config file such as mail_config.php may additionally expose SMTP settings, which is why it is among the probed paths.

The ISC rates the diary threat level Green. No source IPs, user agents, payloads or CVSS score for the current activity were published; the only scoring is the NVD CVSS v2.0 base score of 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) for the historical CVE-2000-0411. Defender guidance from the source is to avoid deploying development artifacts to live websites: remove test and debug mail scripts from production and review web logs for requests to the listed paths.

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Unix Shell

Discovery

T1082 System Information Discovery

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552.001 Credentials In Files

Reconnaissance

T1592.002 Software; T1595.002 Vulnerability Scanning; T1595.003 Wordlist Scanning

Remediation for Legacy mail test scripts

Patches

• Upgrade or replace legacy Matt Wright FormMail installations; versions 1.6 and earlier and 1.9 and earlier are affected by CVE-2000-0411, CVE-2001-0357 and CVE-2002-1771

Immediate actions

• Search web roots for sendmail.php, test-mail.php, testemail.php, mail_config.php, email-test.php, mailtest.php and any FormMail-style scripts, and delete those that are not needed in production
• Review web server access logs for requests to the probed paths and for GET requests carrying recipient/email/to parameters
• Review outbound mail queues and MTA logs for unexpected messages originating from the web server

Workarounds

• Block requests to the listed test-script paths at the WAF or web server
• Move SMTP credentials out of web-accessible configuration files such as /config/mail_config.php

Longer-term hardening

• Exclude development and test scripts from production deployment pipelines
• Require authentication and a fixed, server-side recipient on any web-to-mail form
• Add CAPTCHA and rate limiting to contact forms
• Never pass user-supplied parameters to sendmail binary arguments; use a mail library with validated headers

Affected and fixed versions

• Matt Wright — FormMail (CGI script)
  Vulnerable versions: 1.6 (CVE-2000-0411)
• Various / custom — Leftover PHP development and test e-mail scripts (sendmail.php, mailtest.php, test-mail.php, testemail.php, email-test.php, mail_config.php)
  Vulnerable versions: Any deployment that exposes such a script on a production web server
  Fixed in: Script removed from production

Timeline of Legacy mail test scripts

• 2000-05-10 Original disclosure referenced by NVD in May 2000 via Neohapsis BugTraq archives, Perfecto Tech Black Watch Labs and SecurityFocus BID 1187; the exact BugTraq post date is not stated in the NVD record.
• 2000-05-10 CVE-2000-0411 published in NVD: Matt Wright's FormMail CGI script (1.6) lets remote attackers obtain environment variables via the env_report parameter (CVSS v2 5.0).
• 2001-08-22 CVE-2001-0357 published: locked-ioc-10 1.6 and earlier lets a remote attacker send anonymous spam by modifying the recipient and message parameters (CVSS v2 7.5).
• 2002-12-31 CVE-2002-1771 published: locked-ioc-3 1.9 and earlier (1.0 through 1.9) allows spam or anonymous e-mail via newline injection of CC:, BCC: or additional TO: fields (CVSS v2 5.0).
• 2026-11-04 ISC recommends not leaving development artifacts on live websites; Threadlinqs tracks the activity as TL-2026-5239 with remediation to remove test mail scripts from production.
• 2026-11-04 Johannes Ullrich publishes ISC diary 33488 'The Classics Return: Vulnerable E-Mail Scripts' (threat level Green), assessing the scanners as spammers seeking webforms with controllable recipients.
• 2026-11-04 SANS ISC honeypots observe increased requests for locked-ioc-8, locked-ioc-6, locked-ioc-7, locked-ioc-2, locked-ioc-4, locked-ioc-5 and locked-ioc-9.

Sources cited for Legacy mail test scripts

• NVD - CVE-2000-0411 NVD (NIST) · Advisory · 2000-05-10
• NVD CVE API record for CVE-2001-0357 (FormMail recipient abuse) NVD (NIST) · Advisory · 2001-08-22
• NVD CVE API record for CVE-2002-1771 (FormMail header injection) NVD (NIST) · Advisory · 2002-12-31
• NVD CVE API record for CVE-2000-0411 NVD (NIST) · Advisory · 2000-05-10
• Matt Wright FormMail: security vulnerabilities and CVEs (CVEdetails) cvedetails.com · Research
• CVE-2000-0411 (OpenCVE) app.opencve.io · Research · 2000-05-10
• PT-2000-1353 Matt Wright's FormMail CGI script (PT Security dbugs) dbugs.ptsecurity.com · Research
• Quick & Dirty PHP Mail Test Script (GitHub gist, example cited by ISC) GitHub · Code repository
• The Classics Return: Vulnerable E-Mail Scripts (Johannes Ullrich, SANS ISC) isc.sans.edu · Blog · 2026-11-04

More in vulnerability

• Zyxel GS1900 Switch Zero-Day (CVE-2026-107441) Exploited by Kapibala in Red Heron Campaign, ~1,000 Switches Compromised
• Critical Ruby on Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Allows Server Secret Theft via Malicious Image Uploads to ImageMagick (CVE not yet assigned)
• Debian and Ubuntu APT Flaw (CVE-2026-109518) Lets MitM Attackers Swap Verified Packages and Run Code as Root
• Critical Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Lets Attackers Write Server Files via Crafted ImageMagick Uploads
• Google Chrome 157 Security Update Fixes 213 Bugs Including 7 Critical Vulnerabilities (CVE-2026-121156, CVE-2026-121247, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121203, CVE-2026-121126)