Language: PHP
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
   public function updatePrice_taxfree($post) {
      global $DB;

      $this->getFromDB($post['item_id']);

      $input = $this->fields;
      $discount                   = $input['discount'];
      $plugin_order_ordertaxes_id = $input['plugin_order_ordertaxes_id'];

      $input["price_taxfree"]     = $post['price_taxfree'];
      $input["price_discounted"]  = $input["price_taxfree"] - ($input["price_taxfree"] * ($discount / 100));

      $tax = new PluginOrderOrderTax();
      $tax->getFromDB($plugin_order_ordertaxes_id);

      $input["price_ati"]         = $this->getPricesATI($input["price_discounted"], $tax->getRate());

      $this->update($input);
   }