CVE-2026-31845

Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint

View on CVE.org
Published Apr 11, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Description
A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions. The vulnerable code is: if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']); An unauthenticated attacker can exploit this issue by crafting a malicious URL containing JavaScript payloads. When a victim visits the link, the payload executes in the context of the application within the victim's browser, potentially leading to session hijacking, credential theft, phishing, or account takeover. The issue is fixed in version 3.7, which introduces proper input validation and output encoding to prevent script injection. A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions.
Title Rukovoditel CRM - Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint
Type Values Removed Values Added
Title Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint Rukovoditel CRM - Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint
Type Values Removed Values Added
Title Reflected XSS in Rukovoditel CRM Zadarma API permits session hijacking Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Reflected XSS in Rukovoditel CRM Zadarma API permits session hijacking
Type Values Removed Values Added
First Time appeared Rukovoditel
Rukovoditel rukovoditel
Vendors & Products Rukovoditel
Rukovoditel rukovoditel
Type Values Removed Values Added
Description A pre-authenticated reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type enforcement. The vulnerability is caused by the following code: if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']); This results in arbitrary JavaScript execution in the context of the victim's browser when a crafted URL is visited. An attacker can exploit this issue by sending a malicious link such as: https://TARGET/api/tel/zadarma.php?zd_echo=<script>alert('XSS')</script> When a victim clicks the link, the payload executes in the application context, enabling session theft, phishing, and potential account takeover if sensitive users are targeted. A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions. The vulnerable code is: if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']); An unauthenticated attacker can exploit this issue by crafting a malicious URL containing JavaScript payloads. When a victim visits the link, the payload executes in the context of the application within the victim's browser, potentially leading to session hijacking, credential theft, phishing, or account takeover. The issue is fixed in version 3.7, which introduces proper input validation and output encoding to prevent script injection.
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N'}

 cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H'}
Type Values Removed Values Added
Description A pre-authenticated reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type enforcement. The vulnerability is caused by the following code: if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']); This results in arbitrary JavaScript execution in the context of the victim's browser when a crafted URL is visited. An attacker can exploit this issue by sending a malicious link such as: https://TARGET/api/tel/zadarma.php?zd_echo=<script>alert('XSS')</script> When a victim clicks the link, the payload executes in the application context, enabling session theft, phishing, and potential account takeover if sensitive users are targeted.
Weaknesses CWE-79
References
Metrics cvssV2_0

{'score': 6.4, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:N'}

cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N'}
Earlier changes (3)
Weaknesses

Sources

Status
PUBLISHED
Assigner
TuranSec
Published
Updated
Aug 10, 2026, 11:43 AM
Reserved
Mar 9, 2026, 6:20 PM

View source JSON

Updated
Apr 13, 2026, 5:43 PM

JSON

Status
Deferred
Published
Apr 11, 2026, 7:16 PM
Modified
Oct 26, 2026, 10:10 PM

View source JSON

No data.

Updated
Aug 11, 2026, 12:15 AM

JSON