The code above allows an attacker to execute arbitrary commands with the elevated privilege of the application by modifying the system property APPHOME to point to a different path containing a malicious version of INITCMD. Because the program does not validate the value read from the environment, if an attacker can control the value of the system property APPHOME, then they can fool the application into running malicious code and take control of the system.
The following code is a wrapper around the UNIX command cat which prints the contents of a file to standard out. It is also injectable:
(bad code)
#include <stdio.h>