CVE-2016-10034
CriticalSummary
The setFrom function in the Sendmail adapter in the zend-mail component before versions 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11, may allow remote attackers to pass extra parameters to the mail command, potentially executing arbitrary code via a " (backslash double quote) in a crafted e-mail address.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code remotely, posing a serious threat to the integrity and security of the system.
Recommendation
It is recommended to update the zend-mail component and Zend Framework to the latest versions to mitigate this vulnerability.
Original NVD description (English source)
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address.