Description

This detector identifies PHP parse value shadowing vulnerabilities where parse functions like parse_str() use unsanitized user input as their source parameter. When untrusted data is parsed directly, attackers can inject arbitrary variables into the current scope, potentially overwriting existing variables and leading to security bypasses or code execution.

Detection Strategy

• Identifies calls to PHP parsing functions (likely parse_str, parse_url, or similar parse functions)

• Checks that the function call has exactly one argument (the source parameter)

• Verifies the source argument comes from unsafe user input (GET, POST, REQUEST variables, etc.)

• Confirms the input is not properly sanitized before being passed to the parse function

• Reports vulnerability when untrusted data flows directly into parse functions without validation

Vulnerable code example

<?php

function processRequest() {
    $is_admin = false;
    parse_str($_GET['data']); // Vulnerable: extracts to global scope, can overwrite $is_admin
}

function loadConfig() {...

✅ Secure code example

<?php

function processRequest() {
    $is_admin = false;
    parse_str($_GET['data'], $params); // Safe: extracts to $params array, cannot overwrite $is_admin
}

function loadConfig() {...