email-header-injection

SMTP header injection is a vulnerability where attackers insert CRLF characters into web form inputs to manipulate email headers like Bcc and Cc, enabling spam relay, data exfiltration, and email spoofing.

You can test contact forms for email header injection by submitting crafted CRLF payloads into form fields to identify header manipulation, verify real-world impact through Bcc insertion, and document exploitable scenarios.

Yes, email header injection allows data exfiltration by injecting Bcc headers via unsanitized user input, automatically copying sensitive form submissions or application data to an attacker-controlled email address.

Yes, SMTP header injection testing applies to password reset and registration flows, allowing you to assess header manipulation risks and document remediation steps for these specific web form endpoints.

The best way to prevent CRLF injection in email headers is to apply strict input sanitization, validate header fields, and use safe mail libraries that properly encode user-supplied data before sending.