Language: PHP
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
   public function transfer($ID, $entity) {
      global $DB;

      $supplier  = new PluginOrderOrder_Supplier();
      $reference = new PluginOrderReference();

      $this->getFromDB($ID);
      $this->update([
         "id"          => $ID,
         "entities_id" => $entity,
      ]);

      if ($supplier->getFromDBByOrder($ID)) {
         $supplier->update([
            "id"          => $supplier->fields["id"],
            "entities_id" => $entity,
         ]);
      }

      $query = "SELECT `plugin_order_references_id`
                FROM `glpi_plugin_order_orders_items`
                WHERE `plugin_order_orders_id` = '$ID'
                GROUP BY plugin_order_references_id";
      $result = $DB->query($query);
      if ($DB->numrows($result)) {
         while ($detail = $DB->fetchArray($result)) {
            $ref = $reference->transfer($detail["plugin_order_references_id"], $entity);
         }
      }
   }