Exploitation Summary
EIP tracks 1 public exploit for CVE-2019-16645. PoCs published by Ramikan.
AI-analyzed exploit summary The exploit demonstrates a Host Header Injection vulnerability in GoAhead Web Server 2.5.0, allowing an attacker to spoof the Host header and redirect users to malicious sites. The PoC includes HTTP requests showing how the server trusts and reflects the Host header in redirects.
Description
An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker. This could potentially be used in a phishing attack.
Exploits (1)
The exploit demonstrates a Host Header Injection vulnerability in GoAhead Web Server 2.5.0, allowing an attacker to spoof the Host header and redirect users to malicious sites. The PoC includes HTTP requests showing how the server trusts and reflects the Host header in redirects.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N