CVE-2017-14087

HIGH

Trend Micro OfficeScan XG 12.0 - Host Header Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-14087. PoCs published by hyp3rlinx.

AI-analyzed exploit summary The exploit describes a Host Header Injection vulnerability in TrendMicro OfficeScan, where the 'db_controller.php' script relies on the spoofable HTTP_HOST header instead of SERVER_NAME. This can lead to arbitrary link rendering in cached environments.

Description

A Host Header Injection vulnerability in Trend Micro OfficeScan XG (12.0) may allow an attacker to spoof a particular Host header, allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages.

Exploits (1)

exploitdb WRITEUP VERIFIED
by hyp3rlinx · textwebappsphp
https://www.exploit-db.com/exploits/42895

The exploit describes a Host Header Injection vulnerability in TrendMicro OfficeScan, where the 'db_controller.php' script relies on the spoofable HTTP_HOST header instead of SERVER_NAME. This can lead to arbitrary link rendering in cached environments.

Classification
Writeup 100%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: TrendMicro OfficeScan v11.0 and XG (12.0)
No auth needed
Prerequisites: Access to the target server · Ability to send HTTP requests with custom headers
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (8)

Core 8
Core References
Mitigation, Vendor Advisory x_refsource_confirm
https://success.trendmicro.com/solution/1118372
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/541267/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/101074
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2017/Sep/86
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1039500
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/42895/

Scores

CVSS v3 7.5
EPSS 0.0833
EPSS Percentile 94.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-20
Status published
Products (3)
Trend Micro/Trend Micro OfficeScan XG (12.0)
trendmicro/officescan 11.0
trendmicro/officescan 12.0
Published Oct 06, 2017
Tracked Since Feb 18, 2026