DokuWiki Runcommand Plugin Command Injection Vulnerability

A command injection vulnerability has been identified in the Runcommand plugin for DokuWiki, specifically in versions prior to 2025. This vulnerability allows unauthenticated attackers to execute arbitrary system commands. The issue arises in the file 'lib/plugins/runcommand/postaction.php'.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the server where DokuWiki is hosted.

Reproduction

To reproduce this vulnerability, send a POST request to 'lib/plugins/runcommand/postaction.php' with the 'rcObjectId', 'outputType1', and 'command1' parameters. The 'command1' parameter can be used to specify the command to be executed on the server. For example, sending 'id' as the command will return the user ID and group information of the web server user.