ORSEE 3.1.0 processes participant profile fields in a way that a value beginning with the prefix "func:" is passed directly into a PHP eval() call within tagsets/participant.php and tagsets/options.php. The unchecked input leads to arbitrary PHP code execution, giving such an attacker full control over the application. This flaw corresponds to code injection vulnerabilities such as CWE-94 and can compromise confidentiality, integrity, and availability of the entire system.

The vulnerability affects the Online Recruitment System for Economic Experiments (ORSEE) version 3.1.0. No other vendor or product information is listed, and the flaw is present only in that release.

An attacker must be authenticated to the system and able to edit the participant profile fields. The presence of eval() driven by the "func:" prefix enables any injected code to execute on the server. While no publicly available exploit is cited and the EPSS score is not available, the lack of a CISA KEV listing does not mitigate that the flaw can be fully exploited. The high severity of the flaw is consistent with the remote code execution capability and the absence of built‑in mitigating controls.