When parse_str() is called with only one parameter it parses the supplied
string, as if it were the query string passed via a URL and sets variables in
the global scope. This is achieved by internally switching register_globals on,
while the string is parsed.
For more details see original advisory:
Steps to Reproduce:
*** This bug has been marked as a duplicate of 111032 ***