CVE-2006-1234

CVE-2006-1234 describes a SQL injection vulnerability in DSCounter 1.2, specifically within the index.php file when magic_quotes_gpc is disabled. This flaw allows remote attackers to execute arbitrary SQL commands by manipulating the X-Forwarded-For HTTP header. The vulnerability has a CVSS score of 5.1, indicating a medium severity with potential for partial confidentiality, integrity, and availability impact, requiring high attack complexity. While not listed on CISA's KEV catalog, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.