Language: PHP
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
   public function updateAnalyticNature($post) {
      global $DB;

      $this->getFromDB($post['item_id']);

      $input = $this->fields;
      $input['plugin_order_analyticnatures_id'] = $post['plugin_order_analyticnatures_id'];
      $this->update($input);
   }