EUVD-2025-209885
GHSA-m7f5-wrrg-p669
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionNVD
ORSEE (Online Recruitment System for Economic Experiments) 3.1.0 contains an authenticated Remote Code Execution vulnerability in the participant profile field processing subsystem. Certain field configurations accept values beginning with the prefix "func:" which are passed directly into an eval() call inside tagsets/participant.php and tagsets/options.php.
AnalysisAI
Authenticated remote code execution in ORSEE 3.1.0 allows low-privileged users to execute arbitrary PHP code on the server by submitting participant profile field values prefixed with 'func:', which are passed unsanitized into eval() calls within tagsets/participant.php and tagsets/options.php. Only version 3.1.0 is confirmed affected; ORSEE is a niche academic tool used in economic research labs, limiting broad attack surface but making unpatched deployments attractive targets for insider threat or compromised-credential scenarios. No public exploit identified at time of analysis beyond a published proof-of-concept writeup on Medium, and EPSS sits at 0.06% (18th percentile), reflecting the narrow deployment footprint.
Technical ContextAI
ORSEE (Online Recruitment System for Economic Experiments) is a PHP-based web application used by research institutions to manage experimental participant recruitment. The vulnerability is rooted in CWE-94 (Improper Control of Generation of Code - Code Injection), specifically PHP's eval() function being called with attacker-controlled input. The 'func:' string prefix acts as an undocumented trigger: when a participant profile field value begins with this prefix, the application strips the prefix and passes the remainder directly into eval() without sanitization or sandboxing in at least two files - tagsets/participant.php and tagsets/options.php. This is a classic server-side code injection pattern where user-supplied data crosses the code/data boundary. The CPE data provided is unpopulated (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*), indicating NVD has not yet assigned a formal CPE string to this product, which is consistent with ORSEE being a low-visibility academic open-source project.
RemediationAI
No vendor-released patch has been identified at time of analysis; no patched version number appears in any referenced advisory or repository tag. Organizations running ORSEE 3.1.0 should consult the upstream GitHub repository at https://github.com/orsee/orsee for any commits or tags released after version 3.1.0. As an immediate compensating control, administrators should audit participant profile field configurations and remove or restrict any field types that accept the 'func:' prefix - disabling this feature eliminates the attack vector entirely but may break any legitimate formula-based field functionality that relies on it. Access to ORSEE instances should be restricted to trusted networks or VPN where externally accessible, reducing the pool of users who can submit malicious field values. If participant self-registration is enabled, disabling it until a patch is applied would prevent unauthenticated users from gaining the low-privilege access needed to exploit this flaw, though this disrupts core recruitment workflows. Administrators should also audit PHP error logs for unexpected eval() execution patterns as a detection measure.
Share
External POC / Exploit Code
Leaving vuln.today