Name of the Vulnerable Software and Affected Versions:
DokuWiki versions prior to 2017-02-19e
Description:
The issue arises from the improper encoding of user input in the `call` parameter of the "/lib/exe/ajax.php" API endpoint. This leads to a reflected file download issue, allowing remote attackers to execute arbitrary programs.
Recommendations:
For versions prior to 2017-02-19e, update to a version that properly encodes user input in the `call` parameter of the "/lib/exe/ajax.php" endpoint to prevent reflected file download attacks. As a temporary workaround, consider restricting access to the "/lib/exe/ajax.php" endpoint until a patch is available.