# Email injection

> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/Email_injection
> Markdown URL: https://mediated.wiki/source/Email_injection.md
> Source: https://en.wikipedia.org/wiki/Email_injection
> Source revision: 1329372542
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)

**Email injection** is a [security vulnerability](/source/Security_vulnerability) that can occur in [Internet](/source/Internet) [applications](/source/Application_software) that are used to send [email](/source/Email) messages. It is the email equivalent of [HTTP Header Injection](/source/HTTP_Header_Injection). Like [SQL injection](/source/SQL_injection) attacks, this vulnerability is one of a general class of vulnerabilities that occur when one [programming language](/source/Programming_language) is embedded within another.

When a form is added to a [Web](/source/World_Wide_Web) page that submits data to a Web application, a malicious user may exploit the [MIME](/source/MIME) format to append additional information to the message being sent, such as a new list of recipients or a completely different message body. Because the MIME format uses a [carriage return](/source/Carriage_return) to delimit the information in a message, and only the raw message determines its eventual destination, adding carriage returns to submitted form data can allow a simple guestbook to be used to send thousands of messages at once. A malicious [spammer](/source/Spam_(electronic)) could use this tactic to send large numbers of messages anonymously.[1]

This vulnerability can potentially affect any application that sends email messages based on input from arbitrary users.

## References

1. Dafydd Stuttard & Marcus Pinto (16 March 2011). [*The Web Application Hacker's Handbook: Discovering and Exploiting Security Flaws*](https://books.google.com/books?id=YJKbVzeabJYC&pg=PA322). John Wiley & Sons. pp. 321–324. ISBN 978-1-118-07961-4. Retrieved 11 July 2013.

## External links

- [Email Headers Injection Using mail() Function](http://www.phpsecure.info/v2/article/MailHeadersInject.en.php) (English)
- [Email Headers Injection Using mail() Function](http://www.phpsecure.info/v2/article/MailHeadersInject.php) (French)

---
Adapted from the Wikipedia article [Email injection](https://en.wikipedia.org/wiki/Email_injection) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/Email_injection?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.