Executive brief
ORSEE, a web-based system used by academic institutions to manage recruitment for economic experiments, contains a critical security flaw. An authenticated user can execute unauthorized commands on the underlying server by submitting specially crafted data in participant profile fields. This could lead to a complete takeover of the system, exposure of sensitive research participant data, and disruption of ongoing academic studies.
Technical details
An authenticated remote code execution (RCE) vulnerability exists in ORSEE 3.1.0 within the participant profile field processing subsystem. The vulnerability is rooted in the application's handling of certain field configurations in 'tagsets/participant.php' and 'tagsets/options.php'. Specifically, the application identifies values starting with the 'func:' prefix and passes the subsequent string directly into a PHP eval() call without sufficient sanitization. An attacker with authenticated access can leverage this behavior to execute arbitrary PHP code on the server. This allows for full system compromise, data exfiltration, or lateral movement within the hosting environment.
Affected products
- ORSEE ORSEE (Online Recruitment System for Economic Experiments) 3.1.0
Timeline
- 2026-05-15: disclosed: CVE published to NVD