Language: PHP
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
   public function deleteDelivery($detailID) {
      global $DB;

      $detail = new PluginOrderOrder_Item();
      $detail->getFromDB($detailID);

      if ($detail->fields["itemtype"] == 'SoftwareLicense') {

         $result = $PluginOrderOrder_Item->queryRef($_POST["plugin_order_orders_id"],
                                                    $detail->fields["plugin_order_references_id"],
                                                    $detail->fields["price_taxfree"],
                                                    $detail->fields["discount"],
                                                    PluginOrderOrder::ORDER_DEVICE_DELIVRED);
         $nb = $DB->numrows($result);

         if ($nb) {
            for ($i = 0; $i < $nb; $i++) {
               $detailID = $DB->result($result, $i, 'id');
               $detail->update([
                  "id"                             => $detailID,
                  "delivery_date"                  => 'NULL',
                  "states_id"                      => PluginOrderOrder::ORDER_DEVICE_NOT_DELIVRED,
                  "delivery_number"                => "",
                  "plugin_order_deliverystates_id" => 0,
                  "delivery_comment"               => "",
               ]);
            }
         }

      } else {
         $detail->update([
            "id"                             => $detailID,
            "date"                           => 0,
            "states_id"                      => PluginOrderOrder::ORDER_DEVICE_NOT_DELIVRED,
            "delivery_number"                => "",
            "plugin_order_deliverystates_id" => 0,
            "delivery_comment"               => "",
         ]);
      }
   }