ORSEE 3.1.0 processes participant profile fields in a way that a value beginning with the prefix "func:" is passed directly into a PHP eval() call within tagsets/participant.php and tagsets/options.php. The unchecked input leads to arbitrary PHP code execution, giving an authenticated attacker full control over the application. This flaw corresponds to code injection vulnerabilities such as CWE-94 and can compromise confidentiality, integrity, and availability of the entire system.

The vulnerability affects the Online Recruitment System for Economic Experiments (ORSEE) version 3.1.0. No other vendor or product information is listed, and the flaw is present only in that release.

An attacker must be authenticated to the system and able to edit the participant profile fields. The presence of eval() driven by the "func:" prefix enables any injected code to execute on the server. While no publicly available exploit is cited and the EPSS score is < 1%, the lack of a CISA KEV listing does not mitigate that the flaw can be fully exploited. The CVSS score of 6.3 indicates medium severity, which is consistent with the remote code execution capability and the lack of built‑in mitigating controls.