<?php class foo { public function __wakeup() { echo 'exploited'; } } $userInput = serialize(new foo); echo $userInput; $serialisedStr = serialize([ $userInput, ]); unserialize($serialisedStr);
You have javascript disabled. You will not be able to edit any code.