PHP Object Injection occurs when an insecure user input is passed through the PHP unserialize() function. When we pass a serialized string of an object of a class to an application, the application accepts it, and then PHP reconstructs the object and usually calls a magic method if they are included in the class. Some of the methods are __construct(), __destruct(), __sleep(), and __wakeup().
This leads to SQL injections, file inclusions, and even remote code execution. However, to successfully exploit, we need to know the class name of the object.
