Security risk of using virtual hosts for public and internal sites

I have an Apache server which hosts a public website and an internal website. However, since Apache denotes virtual hosts based on the Host HTTP header, couldn't someone on the Internet request my server's IP with the Host header set to its internal name/IP?