🟡 Medium  |  Source: Microsoft Security Response Center


CVE-2007-3205 is a long-standing vulnerability in PHP’s parse_str() function, which, when called without a second parameter, can allow remote attackers to overwrite arbitrary variables by injecting variable names and values into the parsed string. This can lead to unexpected application behaviour, logic bypass, or further exploitation depending on how the function is used within an application. Microsoft has published information on this CVE via the MSRC update guide.

Security Architect’s Take: Audit any PHP-based workloads running on Azure for use of parse_str() without a second argument and enforce static analysis rules to flag this pattern; given the advisory’s age (2007), focus on legacy applications or third-party components that may not have been reviewed recently.

Original advisory: CVE-2007-3205 The parse_str function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second parameter, might allow remote attackers to overwrite arbitrary variables by specifying variable names and values in the string to be parsed. NOTE: it is not clear whether this is a design limitation of the function or a bug in PHP, although it is likely to be regarded as a bug in Hardened-PHP and Suhosin.