WordPress MU prior to version 2.7 fails to sanitize the Host header correctly in choose_primary_blog function and can be hacked. Sites running in based virtual hosting setup are not affected while they are not the default virtual host.
Upgrade WordPress.