# Increased Scanning for Vulnerable Legacy E-Mail Test Scripts (formail/mailtest.php variants, CVE-2000-0411 lineage)

> SANS ISC honeypots show increased reconnaissance for leftover development/test e-mail scripts (sendmail.php, mailtest.php, mail_config.php and similar) on production web servers. Scripts that accept an attacker-controlled recipient via GET parameters enable spam relay and server configuration disclosure, and some variants that pass parameters to sendmail binaries can allow code execution.

- **Published:** 2026-11-04T13:40:35Z
- **Last reviewed:** 2026-11-04T13:40:35Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5239
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5239.png
- **ID:** TL-2026-5239
- **Severity:** MEDIUM (CVSS 5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 10 (1 shown free below)
- **CVEs:** CVE-2000-0411, CVE-2001-0357, CVE-2002-1771

## Description

On 2026-11-04 Johannes Ullrich of the SANS Internet Storm Center reported (diary 33488, 'The Classics Return: Vulnerable E-Mail Scripts') that honeypots are receiving increased requests for development and test e-mail scripts that were left on production web servers. The observed request paths are /sendmail.php, /test-mail.php, /testemail.php, /config/mail_config.php, /mail_config.php, /email-test.php and /mailtest.php. The word 'test' in most filenames indicates that the scanners are hunting for leftover debugging utilities rather than legitimate production mail handlers. The ISC assesses the likely goal as locating web forms that let the requester set the e-mail recipient, so the host can be used to distribute spam.

The diary draws a line to CVE-2000-0411, a 2000-era flaw in Matt Wright's FormMail CGI script (version 1.6) where the env_report parameter lets a remote attacker obtain server environment variables. The same script family was also abused to send anonymous spam by modifying the recipient and message parameters (CVE-2001-0357, FormMail 1.6 and earlier) and via newline injection of CC:/BCC:/TO: fields in the email and realname variables (CVE-2002-1771, FormMail 1.9 and earlier). The ISC notes three failure modes in this class of script: URL parameters that leak server environment variables, arbitrary 'To' addresses that turn the host into a spam relay, and parameters passed directly to the sendmail binary that can lead to remote code execution.

A public example of the modern pattern is a quick-and-dirty PHP mail test script (GitHub gist Porrapat/60ed7411d933122fc481). It takes the recipient from a GET parameter ('email'), sends only when 'send=true' is present, calls PHP mail() with a body containing HTTP_HOST, SERVER_NAME, REMOTE_ADDR and SCRIPT_FILENAME, and carries the comment 'DONT FORGET TO DELETE THIS SCRIPT WHEN FINISHED!'. Any such script left reachable without authentication gives an unauthenticated visitor a mail relay and a small server-information disclosure. A config file such as mail_config.php may additionally expose SMTP settings, which is why it is among the probed paths.

The ISC rates the diary threat level Green. No source IPs, user agents, payloads or CVSS score for the current activity were published; the only scoring is the NVD CVSS v2.0 base score of 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) for the historical CVE-2000-0411. Defender guidance from the source is to avoid deploying development artifacts to live websites: remove test and debug mail scripts from production and review web logs for requests to the listed paths.

## MITRE ATT&CK

- T1595.003 Wordlist Scanning
- T1595.002 Vulnerability Scanning
- T1592.002 Software
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1082 System Information Discovery
- T1552.001 Credentials In Files

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Legacy E-Mail Test Script Probing, FormMail Parameter Abuse and Header Injection — Exploitation (SPL)** (`TL-2026-5239-SPL-001`)

Splunk SPL variant of the TL-2026-5239 exploitation detection: finds web requests for leftover development/test e-mail scripts (/sendmail.php, /test-mail.php, /testemail.php, /mailtest.php, /email-test.php, /mail_config.php, /config/mail_config.php, formmail.pl) and exploit parameters reported by SANS ISC: env_report= (CVE-2000-0411 environment disclosure), attacker-controlled recipient/email/to with send=true (CVE-2001-0357 and the public PHP mail test gist pattern) and CRLF CC/BCC/TO injection (CVE-2002-1771). Aggregated per client so wordlist scanning (many distinct paths, T1595.003) stands out from a single legitimate form hit; a 200 on mail_config.php escalates risk because it may expose SMTP settings (T1552.001).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1595.003, T1595.002, T1592.002, T1190, T1552.001, T1082
- **Data sources:** web_access_logs, splunk:index=web sourcetype=access_combined, iis_w3c_logs
- **Severity:** medium
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype=access_combined earliest=-24h (method=GET OR method=POST)
| eval path=lower(urldecode(uri_path)), rawqs=lower(coalesce(uri_query,"")), qs=urldecode(rawqs)
| eval probe_path=if(match(path,"(sendmail|mailtest|test-mail|testemail|email-test|mail_config)[.]php$") OR match(path,"/formmail([.](pl|cgi|php))?$"),1,0)
| eval env_report=if(match(qs,"(^|&)env_report="),1,0)
| eval rcpt_abuse=if(match(qs,"(^|&)(email|recipient|to)=[^&]*@") AND match(qs,"(^|&)send=true"),1,0)
| eval hdr_inject=if(match(rawqs,"%0[ad](%20|\+)*(cc|bcc|to)(%3a|:)"),1,0)
| eval cfg_exposed=if(match(path,"mail_config[.]php$") AND status=200,1,0)
| where probe_path=1 OR env_report=1 OR rcpt_abuse=1 OR hdr_inject=1
| stats count AS hits dc(path) AS distinct_paths values(path) AS paths values(status) AS statuses sum(env_report) AS env_report_hits sum(rcpt_abuse) AS recipient_abuse_hits sum(hdr_inject) AS header_injection_hits sum(cfg_exposed) AS config_200_hits min(_time) AS first_seen max(_time) AS last_seen by clientip
| eval risk=if(distinct_paths>=3 OR env_report_hits+recipient_abuse_hits+header_injection_hits+config_200_hits>=1,"high","medium")
| sort - distinct_paths
```

### Microsoft KQL

```kql
W3CIISLog
| where TimeGenerated > ago(24h)
| extend Path = tolower(url_decode(csUriStem)), RawQs = tolower(tostring(csUriQuery))
| extend Qs = url_decode(RawQs)
| extend ProbePath = Path matches regex @"(sendmail|mailtest|test-mail|testemail|email-test|mail_config)\.php$" or Path matches regex @"/formmail(\.(pl|cgi|php))?$"
| extend EnvReport = Qs matches regex @"(^|&)env_report="
| extend RcptAbuse = Qs matches regex @"(^|&)(email|recipient|to)=[^&]*@" and Qs matches regex @"(^|&)send=true"
| extend HdrInject = RawQs matches regex @"%0[ad](%20|\+)*(cc|bcc|to)(%3a|:)"
| extend CfgExposed = Path matches regex @"mail_config\.php$" and tostring(scStatus) == "200"
| where ProbePath or EnvReport or RcptAbuse or HdrInject
| summarize Hits = count(), DistinctPaths = dcount(Path), Paths = make_set(Path, 20), Statuses = make_set(scStatus, 10), EnvReportHits = countif(EnvReport), RecipientAbuseHits = countif(RcptAbuse), HeaderInjectionHits = countif(HdrInject), Config200Hits = countif(CfgExposed), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by cIP, sSiteName
| extend Risk = iff(DistinctPaths >= 3 or EnvReportHits + RecipientAbuseHits + HeaderInjectionHits + Config200Hits >= 1, "high", "medium")
| project FirstSeen, LastSeen, cIP, sSiteName, Hits, DistinctPaths, EnvReportHits, RecipientAbuseHits, HeaderInjectionHits, Config200Hits, Paths, Statuses, Risk
| order by DistinctPaths desc
```

### Sigma

```yaml
title: Leftover E-Mail Test Script Probing, FormMail Parameter Abuse or Header Injection
id: a1f4c2d8-5239-4a1b-8e3c-0b7d9e1f2a01
status: experimental
description: Detects web requests for leftover development/test e-mail scripts (sendmail.php, mailtest.php, test-mail.php, testemail.php, email-test.php, mail_config.php, formmail), the CVE-2000-0411 env_report parameter, attacker-controlled recipient parameters (CVE-2001-0357) and CRLF CC/BCC/TO header injection (CVE-2002-1771), as observed by SANS ISC honeypots (TL-2026-5239).
references:
    - https://isc.sans.edu/diary/33488
    - https://nvd.nist.gov/vuln/detail/cve-2000-0411
    - https://nvd.nist.gov/vuln/detail/cve-2001-0357
    - https://nvd.nist.gov/vuln/detail/cve-2002-1771
    - https://gist.github.com/Porrapat/60ed7411d933122fc481
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.reconnaissance
    - attack.t1595.003
    - attack.t1595.002
    - attack.t1592.002
    - attack.initial-access
    - attack.t1190
    - attack.credential-access
    - attack.t1552.001
    - attack.discovery
    - attack.t1082
    - cve.2000-0411
    - cve.2001-0357
    - cve.2002-1771
logsource:
    category: webserver
detection:
    selection_path:
        c-uri|contains:
            - '/sendmail.php'
            - '/test-mail.php'
            - '/testemail.php'
            - '/mailtest.php'
            - '/email-test.php'
            - '/mail_config.php'
    selection_formmail:
        c-uri|contains: '/formmail.'
    selection_envreport:
        cs-uri-query|contains: 'env_report='
    selection_rcpt_key:
        cs-uri-query|contains:
            - 'email='
            - 'recipient='
            - 'to='
    selection_rcpt_send:
        cs-uri-query|contains|all:
            - 'send=true'
            - '@'
    selection_hdr_inject:
        cs-uri-query|re: '(?i)%0[ad](%20|\+)*(cc|bcc|to)(%3a|:)'
    condition: selection_path or selection_formmail or selection_envreport or selection_hdr_inject or (selection_rcpt_key and selection_rcpt_send)
falsepositives:
    - Authorized vulnerability scanners and external attack-surface assessments
    - Legitimate contact forms that happen to use one of the listed filenames
level: medium
```

**Known false positives:**

- Authorized vulnerability scanners and external attack-surface management tools requesting the same paths
- A legitimate production contact form that uses one of the listed filenames (for example /sendmail.php) and posts the recipient server-side
- Developers or QA testing a staging mail script from a known source address

**Tuning notes:** Change index/sourcetype to match your web log onboarding (nginx:plus:access, iis, etc.). Exclude known scanner and monitoring source IPs with a lookup and raise the distinct_paths threshold on very noisy internet-facing sites. Any env_report, header-injection or recipient-abuse hit, or a 200 response to mail_config.php, deserves immediate triage; also delete the scripts themselves. TL_OSINT_Scan shows no community-corroborated IOCs or sibling infrastructure for this threat yet, so the logic is path/parameter based rather than IP based.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Legacy E-Mail Test Script Probing, FormMail Parameter Abuse and Header Injection — Exploitation (KQL) (locked: unlock with TL Creds)
- Web Server Worker Spawning Sendmail With Injection Arguments, Shell/Discovery Utilities or Mail Config Reads — Post-Exploitation (KQL) (locked: unlock with TL Creds)
- Web Server Process Initiating Outbound SMTP — Spam Relay and Mail-Based Data Egress — C2 / Egress (KQL) (locked: unlock with TL Creds)
- Legacy E-Mail Test Script Probing, FormMail Parameter Abuse and Header Injection — Exploitation (Sigma) (locked: unlock with TL Creds)
- Web Server Worker Spawning Sendmail With Injection Arguments, Shell/Discovery Utilities or Mail Config Reads — Post-Exploitation (Sigma) (locked: unlock with TL Creds)
- Web Server Process Initiating Outbound SMTP — Spam Relay and Mail-Based Data Egress — C2 / Egress (Sigma) (locked: unlock with TL Creds)
- Web Server Worker Spawning Sendmail With Injection Arguments, Shell/Discovery Utilities or Mail Config Reads — Post-Exploitation (SPL) (locked: unlock with TL Creds)
- Web Server Process Initiating Outbound SMTP — Spam Relay and Mail-Based Data Egress — C2 / Egress (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 10)

Defanged, TLP:CLEAR.

- URL: `hxxps://gist[.]github[.]com/Porrapat/60ed7411d933122fc481`

Full set of 10 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The Classics Return: Vulnerable E-Mail Scripts (Johannes Ullrich, SANS ISC)](https://isc.sans.edu/diary/33488)
- [NVD - CVE-2000-0411](https://nvd.nist.gov/vuln/detail/cve-2000-0411)
- [NVD CVE API record for CVE-2001-0357 (FormMail recipient abuse)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2001-0357)
- [NVD CVE API record for CVE-2002-1771 (FormMail header injection)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2002-1771)
- [NVD CVE API record for CVE-2000-0411](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2000-0411)
- [Quick & Dirty PHP Mail Test Script (GitHub gist, example cited by ISC)](https://gist.github.com/Porrapat/60ed7411d933122fc481)
- [Matt Wright FormMail: security vulnerabilities and CVEs (CVEdetails)](https://www.cvedetails.com/vulnerability-list/vendor_id-30/product_id-44/Matt-Wright-Formmail.html)
- [CVE-2000-0411 (OpenCVE)](https://app.opencve.io/cve/CVE-2000-0411)
- [PT-2000-1353 Matt Wright's FormMail CGI script (PT Security dbugs)](https://dbugs.ptsecurity.com/vulnerability/PT-2000-1353)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5239