I don't think you'll be able to exploit it remotely directly, but indirectly this sort of thing is more realistic. For example, many popular PHP applications s

I don't think you'll be able to exploit it remotely directly, but indirectly this sort of thing is more realistic. For example, many popular PHP applications store serialized data as strings in its database. An SQL exploit like the one Drupal had some time ago could allow an attacker to modify that data.