Widzisz Maćku - a mnie się dostało za takie coś:
FTP URL relaying
Some web browsers (Konqueror using kdelibs < 3.3.2-r2, Internet Explorer (unpatched as of 2005/01/11)) have insecurities in their FTP client implementations. Unlike HTTP servers, FTP servers do not understand URL escaping. Therefor, the client does the decoding of the URL internally (%20 -> ' ', etc). The effected browsers do not treat %0d and %0a specially. Additionally, the effected browsers have no problem initiating FTP conversations to port 25, normally used for SMTP. The browser waits for an FTP greeting banner, but the SMTP greeting banner is in the same basic format. This means that a URL like:
ftp://foo%0d%0aHELO%20test:bar@mx.victim.com:25/
generates a conversation like:
<<< 220 mx.victim.com ESMTP
>>> USER foo
<<< 502 unimplemented (#5.5.1)
>>> HELO test
>>> 220 mx.victim.com
However, the USER and HELO commands are pipelined, so the browser doesn't look for a response until after they are all executed. A long URL can be used to send HELO, MAIL FROM, RCPT TO, DATA, and the message contents, sending an email while the browser still believes it is sending a username.
Czyli za to że ktoś z netu kliknął na jakimś URL'u i to spowodowało wysłanie maila (lub maili) - o ile dobrze to rozumiem. BEZ SENSU! Zwłaszcza że nie mam obsługi maila na routerze (Freesco zresztą)
Czyli - zostałem ukarany za to, że w IE lub innej przeglądarce są błędy...