high8.6Public exploit code
CVE-2019-16645
An issue was discovered in Embedthis GoAhead 2.5.0.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- GoAhead 2.5.0 - Host Header Injection2019-09-30 · remote · multiple
Impact
An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker. This could potentially be used in a phishing attack.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Embedthis | Goahead | Version 2.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/154652/GoAhead-2.5.0-Host-Header-Injection.html
- https://github.com/Ramikan/Vulnerabilities/blob/master/GoAhead%20Web%20server%20HTTP%20Header%20Injection
- http://packetstormsecurity.com/files/154652/GoAhead-2.5.0-Host-Header-Injection.html
- https://github.com/Ramikan/Vulnerabilities/blob/master/GoAhead%20Web%20server%20HTTP%20Header%20Injection