			$res = @unserialize ( base64_decode (str_replace ( array ( "|02" , "|01" ) , array ( "/" , "|" ) , $str ) ) ) ;
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.