Insecure deserialization

When it applies

The app takes serialized objects from the client (cookies, hidden fields, params, message queues) and deserializes them. Recognizable by format markers.

Why it works

Deserialization reconstructs objects and can invoke their methods (magic methods, readObject, __wakeup). A crafted object graph ("gadget chain") strings together existing library methods to reach a dangerous sink — command execution — during/after deserialization.