CVE-2007-3205

Imagine a form on your website that's supposed to fill in a few specific blanks, but due to a coding shortcut, a visitor could sneak in extra 'blanks' that overwrite other settings behind the scenes. That's roughly what this PHP function flaw allows, but only if a developer used it in a particular careless way.

This matters to you only if your website or app runs custom PHP code (directly, or via Hardened-PHP or Suhosin extensions) that calls the parse_str() function. Most standard websites, store platforms, and plugins don't trigger this, since it depends on how a developer specifically wrote their code. It's only a risk if that vulnerable coding pattern exists in software reachable by visitors from the internet.

There is no evidence anyone is exploiting this, no public exploit tool exists, and it isn't on any government list of actively attacked vulnerabilities. This is a low-urgency item — worth a mention to your developer during normal maintenance, not something to act on urgently.

Confirm exposure by searching your custom PHP codebase (not core PHP itself, unless running an ancient unpatched version) for calls to parse_str($string) without a second $result array argument — these calls write parsed keys directly into the current variable scope, enabling variable-overwrite if the input string is attacker-controlled (e.g., from query strings or POST bodies). No vendor patch or fixed version is tracked for this CVE in the findings; the long-standing community-recommended fix is to always call parse_str($string, $result) and reference $result['key'] instead of relying on implicit global/local variable creation. If using Suhosin or Hardened-PHP, check whether their configuration mitigates variable overwrite (e.g., suhosin.simulation or variable blacklisting features) as an interim workaround while code is reviewed. No CISA KEV due date applies since this is not in KEV. Monitor for unexpected variable state in application logs or unexplained logic bypasses in forms/pages that process raw query strings via parse_str.

CVSS 5.0 (MEDIUM, AV:N/AC:L/Au:N/C:N/I:P/A:N) — network-exploitable, no authentication required, integrity-impact only (no confidentiality or availability impact). Weakness category is CWE-Other (unclassified; functions as an input-validation/variable-scope issue). EPSS predicts a low likelihood of exploitation (flat trend, 82nd percentile — low priority relative to the broader vulnerability population). Not listed in CISA KEV; no public exploit code identified; no confirmed real-world exploitation reported. No fixed version or patch advisory is tracked — remediation is a secure-coding fix (supplying the second argument) rather than a software update.