CVE-2016-10131
CriticalSummary
In CodeIgniter before version 3.1.3, a vulnerability exists in Email.php that allows remote attackers to execute arbitrary code. Attackers can leverage control over the email->from field to inject sendmail command-line arguments.
Risk Assessment
This vulnerability can lead to remote code execution, posing a serious threat to application security and user data. Organizations may be exposed to attacks that could result in data loss or system takeover.
Recommendation
It is recommended to update CodeIgniter to version 3.1.3 or later to mitigate this vulnerability. Additionally, conducting a security audit of the application to identify other potential threats is advisable.
Original NVD description (English source)
system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insert sendmail command-line arguments.