DokuWiki remote PHP code injection
Stefan Esser has found a critical security issue in DocuWiki. The bug allows remote PHP code injection through its AJAX spellchecking service. It is due to /e modifier of preg_replace() that handles links that are embedded in the text and translates them in an unsafe way. Stefan has posted an advisory with details about the bug and a recommendation to upgrade.
While searching for the perfect Wiki PHP application for my own german/korean wiki, I tested DokuWiki and found an ugly security hole that allows remote PHP code injection through it's AJAX spellchecking service.
AJAX Magazine's RSS
Twitter page
Facebook page