Language: PHP
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
   public function checkIfDetailExists($orders_id, $only_delivered = false) {
      if ($orders_id) {
         $detail = new PluginOrderOrder_Item();
         $where  = ['plugin_order_orders_id' => $orders_id];
         if ($only_delivered) {
            $where['states_id'] = ['>', 0];
         }
         return (countElementsInTable("glpi_plugin_order_orders_items", $where));
      } else {
         return false;
      }
   }