2

I created a Joomla 2.5 site (needs updated I know) for a client a while back, the site hasn't been maintained in quite a while. They contacted me today concerned about an email which was (thought to be) sent from the website - via the contact form.

Basically they have a single contact form on their site, name, email, message, send. Once sent this email goes to [email protected]

Today an email was sent to hundreds of people with the title 'This is an enquiry email via theirdomain.com'. The message content was rubbish.

My question - is it possible to 'hack' the website contact form in this way? So that it sends to many people. Or, is it more likely that it's a spoofing scam? I know it's very easy to spoof a senders email address in this way. I know I could check the headers however I don't have the original email currently.

I would just like to re-assure the client that the email wad definitely not sent via the website. Also one more question, is it possible to disable the Joomla mail function completely?

I'm not aware of any logs that I can check to confirm any of the above.

Any advice or direction will be appreciated.

Improve this question
1
  • 3
    You'll need the headers to make sure you're site hasn't been hacked, but most likely it is just a spoofing scam. When you say the message was sent to "hundreds of people", does it mean that you have a list? You could easily realize where the problem lies comparing your userlist to the receivers. Do all of them have an account in your website? The other thing I can think of is to ask your host provider for the smtp logs.
    – mattosmat
    Commented May 30, 2015 at 18:31

1 Answer 1

Reset to default
2

Most likely spoofing but you may be able to use the Email Trace tool in cPanel (or similar) to check if an email was sent to a particular email address from the account. If there is no tool available for you to check this, you could ask your web hosting provider to check for you.

As you already realise, seeing the original email headers may help verify the origin of the emails.

As a precaution, and to reassure your client, I'd be inclined to perform a security audit including updating Joomla to the latest version in the series (2.5.28), and all third party extensions on the website to the latest versions (if they're not already updated).

mysites.guru (formerly myjoomla.com) and sucuri.net are examples of services that can help with this and I am sure there are others.

Improve this answer
1
  • Excellent advice @Neil Robertson thanks. I will try to get access to the hosting mail logs and have a better look. I think you are correct though it seems to be spoofing, there aren't many registered users on the site (5) and the email was sent out to many more. I was concerned that the contact form could somehow have been hacked to perform something like this - I guess not?
    – jonboy
    Commented Jun 1, 2015 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.