Language: PHP
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
   public function dropdownReceptionActions($itemtype, $plugin_order_references_id, $plugin_order_orders_id) {
      global $CFG_GLPI;

      $rand = mt_rand();

      echo "<select name='receptionActions$rand' id='receptionActions$rand'>";
      echo "<option value='0' selected>".Dropdown::EMPTY_VALUE."</option>";
      echo "<option value='reception'>".__("Take item delivery", "order")."</option>";
      echo "</select>";
      $params = [
         'action'                     => '__VALUE__',
         'itemtype'                   => $itemtype,
         'plugin_order_references_id' => $plugin_order_references_id,
         'plugin_order_orders_id'     => $plugin_order_orders_id,
      ];
      Ajax::updateItemOnSelectEvent("receptionActions$rand", "show_receptionActions$rand",
                                    Plugin::getWebDir('order')."/ajax/receptionactions.php",
                                    $params);
      echo "<span id='show_receptionActions$rand'>&nbsp;</span>";
   }