Secunia

Two vulnerabilities have been identified in MLdonkey allowing malicious HTML documents such as emails and web pages to access the admin interface and conduct Cross Site Scripting.

The problem is that there isn't any verification of the origin of the request and that certain input isn't properly verified allowing Cross Site Scripting.

A request for the following URL will open the admin interface for access by any IP:
http://127.0.0.1:4080/submit?setoption=q&option=allowed_ips&value=255.255.255.255

Solution
Filter HTML documents with references to local resources such as "localhost" and "127.0.0.1" using a proxy server.

Provided and/or discovered by
Chris Sharp

Deep Links
Links available in Customer Area