CyberRota Analysis
AI-GeneratedA host header injection vulnerability in PicoCMS versions up to 2.1.4 allows unauthenticated remote attackers to manipulate the origin of JavaScript and CSS assets due to improper validation of request headers when the base_url is unset. This can lead to the loading of malicious resources from an attacker-controlled domain, potentially compromising the integrity of the web application. Organizations using affected versions of PicoCMS should prioritize patching this vulnerability to mitigate risks associated with resource injection attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.