Description
This script is using the PHP function unserialize() on user input. This is not recommended as it can lead to various vulnerabilities. Consult "Web references" for more information about this problem.
unserialize() takes a single serialized variable and converts it back into a PHP value. However, if the variable being unserialized is an object, after successfully reconstructing the object PHP will automatically attempt to call the __wakeup(), __destruct() member functions (if they exist). In some cases, this can lead to PHP code execution.
Remediation
It is not recommended to use unserialize() on user input.
References
Related Vulnerabilities
WordPress Plugin User Avatar TimThumb Arbitrary File Upload (1.3.7)
WordPress 4.2.x Denial of Service Vulnerability (4.2 - 4.2.19)
Ruby Improper Input Validation Vulnerability (CVE-2011-4815)
Apache OFBiz XMLRPC Deserialization RCE (CVE-2020-9496/CVE-2023-49070)
TYPO3 Improper Input Validation Vulnerability (CVE-2013-4250)