I was using a module called netquery and a file called netinfo. Both of these apparently don't parse the form correctly and when the right IP and file are inserted and a traceroute done they give full access to your passwords and database and all. I liked the modules and it would be great if someone could fix them (if there is already a fix for this please let me know) but until then I recommend that you remove them from your sites.
If anyone is interested in how email me at wildwoman@xtremeoverclockers.com