cve/2019/CVE-2019-16645.md

### [CVE-2019-16645](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16645)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker. This could potentially be used in a phishing attack.

### POC

#### Reference
- http://packetstormsecurity.com/files/154652/GoAhead-2.5.0-Host-Header-Injection.html
- https://github.com/Ramikan/Vulnerabilities/blob/master/GoAhead%20Web%20server%20HTTP%20Header%20Injection

#### Github
No PoCs found on GitHub currently.