Post-authenticated RCE in SquirrelMail Sendmail transport

CVE-2017-7692 is a post-authentication remote code execution vulnerability in SquirrelMail affecting 1.4.22 and other versions before squirrelmail-20170427_0200-SVN.stable, including versions up to 1.4.23 as described in the provided content. The flaw is in Deliver_SendMail.class.php, specifically the initStream function, where SquirrelMail constructs a command line for the local Sendmail binary and incorrectly sanitizes attacker-controlled input with escapeshellcmd(). The vulnerable input is the envelope sender / Return-Path value derived from the user's configured email address, notably the -f$envelopefrom portion of the Sendmail command line. Because the sanitization is insufficient for this context and does not properly prevent argument injection via whitespace or tab characters, an authenticated user can inject additional Sendmail parameters. If the target deployment uses Sendmail as a command-line transport, the attacker can supply options such as -C to force Sendmail to load an attacker-controlled sendmail.cf file, which can then trigger arbitrary shell command execution on the server. The provided content also notes proof-of-concept exploitation by uploading a malicious sendmail.cf as an attachment, modifying the user's email address setting to inject Sendmail arguments, and then sending an email to trigger execution.