CGI versions before 5.00 for Perl trust the client-supplied X-Forwarded-Host header when constructing URLs such as url, self_url, virtual_host, and virtual_port. This header is used without validation, allowing an attacker to influence redirect locations, base hrefs, and form actions. This can lead to cache poisoning and the generation of URLs that point to attacker-controlled hosts.