Here is the way to go:

Runtime rt = Runtime.getRuntime();
String[] commands = {"system.exe", "-get t"};
Process proc = rt.exec(commands);

BufferedReader stdInput = new BufferedReader(new 
     InputStreamReader(proc.getInputStream()));

BufferedReader stdError = new BufferedReader(new 
     InputStreamReader(proc.getErrorStream()));

// Read the output from the command
System.out.println("Here is the standard output of the command:\n");
String s = null;
while ((s = stdInput.readLine()) != null) {
    System.out.println(s);
}

// Read any errors from the attempted command
System.out.println("Here is the standard error of the command (if any):\n");
while ((s = stdError.readLine()) != null) {
    System.out.println(s);
}

Read the Javadoc for more details here. ProcessBuilder would be a good choice to use.

I ran your program, linked to a checkfileindirectory.sh that looks like this:

#!/bin/bash

echo $1 > param1.txt
echo $2 > param2.txt

As a test, I changed "<file_to_find>" to "<file_to_find>;touch MikeWasHere.txt"

String[] cmdArr = { "bash", "checkfileindirectory.sh", "<directory_to_search>", "<file_to_find>;touch MikeWasHere.txt" };

And I get this output:

➜  /tmp javac FindFileInDir.java
➜  /tmp java FindFileInDir 
➜  /tmp cat param1.txt 
<directory_to_search>
➜  /tmp cat param2.txt 
<file_to_find>;touch MikeWasHere.txt
➜  /tmp ls MikeWasHere.txt
ls: cannot access 'MikeWasHere.txt': No such file or directory

So it looks like java's rt.exec() is injection-safe.

OWASP's page on command injection has a paragraph about java's exec (emphasis mine):

C’s system function passes its arguments to the shell (/bin/sh) to be parsed, whereas Runtime.exec tries to split the string into an array of words, then executes the first word in the array with the rest of the words as parameters. Runtime.exec does NOT try to invoke the shell at any point. The key difference is that much of the functionality provided by the shell that could be used for mischief (chaining commands using “&”, “&&”, “|”, “||”, etc, redirecting input and output) would simply end up as a parameter being passed to the first command

That seems consistent with our experiment that java's rt.exec() is injection-safe.

You are not capturing STDERR, so when errors occur you do not receive them from STDOUT (which you are capturing). Try:

CopyBufferedReader input = new BufferedReader(new InputStreamReader(
               pr.getErrorStream()));