PHP : Object injection

The application uses the function unserialize(). During the object deserialization the magic method __wakeup() is automatically executed. An attacker can create a serialized object with the data not provided by the specification, submit it as an argument to unserialize() and thus execute __wakeup() with incorrect or malicious parameters. For example, if __wakeup() deletes the file, an attacker can influence which file will be deleted. Object injection can also occur through other magical methods, in particular, __destruct().