🟡 Medium | Source: Microsoft Security Response Center
CVE-2007-3205 is a long-standing vulnerability in PHP’s parse_str() function, which, when called without a second parameter, can allow remote attackers to overwrite arbitrary variables by injecting variable names and values into the parsed string. This can lead to unexpected application behaviour, logic bypass, or further exploitation depending on how the function is used within an application. Microsoft has published information on this CVE via the MSRC update guide.
Security Architect’s Take: Audit any PHP-based workloads running on Azure for use of parse_str() without a second argument and enforce static analysis rules to flag this pattern; given the advisory’s age (2007), focus on legacy applications or third-party components that may not have been reviewed recently.