Unverified50% confidenceFactExact time
邮件头注入通过插入CRLF字符追加额外邮件头，属于逻辑推断型漏洞，无法通过简单Payload枚举发现
1
Sources
50%
Confidence
Long-term
Relevance
7/6/2026
First Seen
Sources
用Claude打造自动化渗透测试系统：Memory+Skills+Agent实战解析
bilibili王尼互7/5/2026
Related Claims
Unverified邮件头注入是一种服务端注入漏洞，当Web应用将用户输入未经过滤拼接进邮件头时，攻击者可通过插入CRLF进行攻击77% similarUnverifiedSPF验证的是信封发件人（Return-Path）而非用户可见的头部发件人字段，且在邮件转发场景下容易失效61% similarUnverifiedDKIM 签名与传输路径无关，即使邮件多次转发只要签名部分未被修改验证仍有效，弥补了 SPF 在转发场景的短板60% similarUnverified邮件转发中Received字段记录每一跳服务器信息，Return-Path字段存储退信地址，X-Forwarded-To等扩展头字段可能暴露真实收件人59% similarVerifiedDKIM通过非对称加密为邮件头部添加数字签名，验证邮件在传输过程中未被篡改57% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/114902API
curl https://kongchang.com/api/v1/knowledge/claims/114902MCP
get_claim(id=114902)