The vulnerability in ORSEE 3.1.0 involves the participant profile field processing subsystem where inputs prefixed with "func:" are evaluated directly via PHP's eval() function in tagsets/participant.php and tagsets/options.php. This design flaw enables authenticated users to execute arbitrary code remotely by injecting malicious payloads into these fields. The vulnerability requires authentication and affects the specified version of ORSEE. There is no CVSS score or vendor advisory detailing remediation or patch availability.

An authenticated attacker can execute arbitrary code on the server hosting ORSEE 3.1.0 by exploiting the eval() call on specially crafted participant profile fields. This can lead to full compromise of the affected system, including data theft, service disruption, or further network pivoting. No known exploits in the wild have been reported, and no official patch or fix has been disclosed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users and consider limiting the ability to modify participant profile fields that accept the "func:" prefix. Avoid using or deploying ORSEE 3.1.0 in untrusted environments. Monitor official ORSEE channels for updates or patches addressing this vulnerability.