Zennoxa Shield
Rules / PHP
SHIELD-PHP-009

Unsafe deserialization of user input

criticalPHPCWE-502CVSS 9.8

What it detects

unserialize is called on request data allowing object injection and remote code execution.

How to fix

Use json_decode for untrusted data or pass allowed_classes=>false to unserialize.

Vulnerable — Shield flags thiscart.php
<?php
// Shopping cart restore — vulnerable to PHP object injection
$cart = unserialize($_COOKIE['cart'] ?? '');
foreach ($cart as $item) {
    echo htmlspecialchars($item['name'], ENT_QUOTES) . '<br>';
}
Fixed — scans cleancart.php
<?php
// JSON is a data-only format — no PHP objects can be injected
$cart = json_decode($_COOKIE['cart'] ?? '[]', true) ?: [];
foreach ($cart as $item) {
    echo htmlspecialchars($item['name'], ENT_QUOTES) . '<br>';
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-009, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PHP-009: Unsafe deserialization of user input — Zennoxa Shield