Executive brief
GigToDo, a platform used for managing freelance marketplaces, contains a security flaw in its proposal creation system. An authenticated user can upload a malicious proposal that, when viewed by other users or administrators, executes hidden code in their browser. This could allow an attacker to steal login sessions, redirect users to fraudulent websites, or perform unauthorized actions on behalf of an administrator.
Technical details
A persistent cross-site scripting (XSS) vulnerability exists in GigToDo version 1.3 and earlier. The flaw is located in the 'Proposal Description' field within the create_proposal endpoint, which fails to properly neutralize user-supplied input. An authenticated attacker can inject malicious JavaScript or HTML; notably, the exploit requires the attacker to save the proposal twice for the payload to persist correctly. When an administrator or another user views the malicious proposal, the script executes in their browser context, potentially leading to session cookie theft (CWE-79) or unauthorized redirects. Public exploits are available, but no official patch has been confirmed in the advisory text.
Affected products
- GigToDo GigToDo Freelance Marketplace Script <= 1.3
Timeline
- 2019-07-28: disclosed: Initial discovery and exploit publication by m0ze
- 2026-06-04: advisory: CVE published and NVD record created