What is the CVSS score of CVE-2025-67031?

CVE-2025-67031 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

ORSEE CVE-2025-67031

EUVD-2025-209885 MEDIUM

Code Injection (CWE-94)

2026-05-15 mitre

GHSA-m7f5-wrrg-p669

RCE PHP Code Injection

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 16:23 vuln.today

CVSS changed

May 18, 2026 - 16:22 NVD

6.3 (MEDIUM)

CVE Published

May 15, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

ORSEE (Online Recruitment System for Economic Experiments) 3.1.0 contains an authenticated Remote Code Execution vulnerability in the participant profile field processing subsystem. Certain field configurations accept values beginning with the prefix "func:" which are passed directly into an eval() call inside tagsets/participant.php and tagsets/options.php.

AnalysisAI

Authenticated remote code execution in ORSEE 3.1.0 allows low-privileged users to execute arbitrary PHP code on the server by submitting participant profile field values prefixed with 'func:', which are passed unsanitized into eval() calls within tagsets/participant.php and tagsets/options.php. Only version 3.1.0 is confirmed affected; ORSEE is a niche academic tool used in economic research labs, limiting broad attack surface but making unpatched deployments attractive targets for insider threat or compromised-credential scenarios. No public exploit identified at time of analysis beyond a published proof-of-concept writeup on Medium, and EPSS sits at 0.06% (18th percentile), reflecting the narrow deployment footprint.

Technical ContextAI

ORSEE (Online Recruitment System for Economic Experiments) is a PHP-based web application used by research institutions to manage experimental participant recruitment. The vulnerability is rooted in CWE-94 (Improper Control of Generation of Code - Code Injection), specifically PHP's eval() function being called with attacker-controlled input. The 'func:' string prefix acts as an undocumented trigger: when a participant profile field value begins with this prefix, the application strips the prefix and passes the remainder directly into eval() without sanitization or sandboxing in at least two files - tagsets/participant.php and tagsets/options.php. This is a classic server-side code injection pattern where user-supplied data crosses the code/data boundary. The CPE data provided is unpopulated (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*), indicating NVD has not yet assigned a formal CPE string to this product, which is consistent with ORSEE being a low-visibility academic open-source project.

RemediationAI

No vendor-released patch has been identified at time of analysis; no patched version number appears in any referenced advisory or repository tag. Organizations running ORSEE 3.1.0 should consult the upstream GitHub repository at https://github.com/orsee/orsee for any commits or tags released after version 3.1.0. As an immediate compensating control, administrators should audit participant profile field configurations and remove or restrict any field types that accept the 'func:' prefix - disabling this feature eliminates the attack vector entirely but may break any legitimate formula-based field functionality that relies on it. Access to ORSEE instances should be restricted to trusted networks or VPN where externally accessible, reducing the pool of users who can submit malicious field values. If participant self-registration is enabled, disabling it until a patch is applied would prevent unauthenticated users from gaining the low-privilege access needed to exploit this flaw, though this disrupts core recruitment workflows. Administrators should also audit PHP error logs for unexpected eval() execution patterns as a detection measure.