Language: PHP
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
function plugin_order_displayConfigItem($type, $ID, $data, $num) {
   global $CFG_GLPI;

   $searchopt = &Search::getOptions($type);
   $table = $searchopt[$ID]["table"];
   $field = $searchopt[$ID]["field"];
   switch ($table.'.'.$field) {
      case "glpi_plugin_order_orders.is_late":
         $message = "";
         if ($data['raw']["ITEM_".$num]) {
            $config = PluginOrderConfig::getConfig();
            if ($config->getShouldBeDevileredColor() != '') {
               $message .= " style=\"background-color:".$config->getShouldBeDevileredColor().";\" ";
            }
         }
         return $message;

   }
}