Description
A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions.
Published: 2026-04-11
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a reflected cross‑site scripting flaw in Rukovoditel CRM’s Zadarma telephony API endpoint '/api/tel/zadarma.php'. The application incorrectly outputs user input from the 'zd_echo' GET parameter without sanitisation, output encoding, or content‑type restrictions. Because the input is reflected unchanged, an attacker can create a crafted URL that injects malicious JavaScript into the browser of any user who visits it, potentially enabling the attacker to run arbitrary code, steal session cookies, or conduct phishing. This is a classic input‑validation weakness, CWE‑79.

Affected Systems

The flaw affects Rukovoditel CRM versions 3.6.4 and earlier. The vulnerable endpoint is /api/tel/zadarma.php.

Risk and Exploitability

With a CVSS score of 9.3 the vulnerability is classified as Critical. The EPSS score of < 1 % indicates a very low probability of exploitation at present, yet the flaw remains publicly known. The issue is exploitable without authentication through a simple URL, making it likely to be leveraged by attackers. Immediate action is required.

Generated by OpenCVE AI on August 11, 2026 at 00:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available vendor patch or upgrade Rukovoditel CRM to a version that fixes the reflected XSS flaw.
  • Sanitize or validate the zd_echo GET parameter – remove echo or enforce content‑type restrictions to prevent arbitrary script injection.
  • Limit the exposure of the /api/tel/zadarma.php endpoint to authorized personnel only, for example by restricting access with authentication tokens or IP filtering.

Generated by OpenCVE AI on August 11, 2026 at 00:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions. The vulnerable code is: if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']); An unauthenticated attacker can exploit this issue by crafting a malicious URL containing JavaScript payloads. When a victim visits the link, the payload executes in the context of the application within the victim's browser, potentially leading to session hijacking, credential theft, phishing, or account takeover. The issue is fixed in version 3.7, which introduces proper input validation and output encoding to prevent script injection. A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions.
Title Rukovoditel CRM - Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint

Mon, 10 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Title Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint Rukovoditel CRM - Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint

Wed, 05 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
Title Reflected XSS in Rukovoditel CRM Zadarma API permits session hijacking Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint

Mon, 13 Apr 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Apr 2026 14:30:00 +0000

Type Values Removed Values Added
Title Reflected XSS in Rukovoditel CRM Zadarma API permits session hijacking

Mon, 13 Apr 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Rukovoditel
Rukovoditel rukovoditel
Vendors & Products Rukovoditel
Rukovoditel rukovoditel

Sat, 11 Apr 2026 19:15:00 +0000

Type Values Removed Values Added
Description A pre-authenticated reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type enforcement. The vulnerability is caused by the following code: if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']); This results in arbitrary JavaScript execution in the context of the victim's browser when a crafted URL is visited. An attacker can exploit this issue by sending a malicious link such as: https://TARGET/api/tel/zadarma.php?zd_echo=<script>alert('XSS')</script> When a victim clicks the link, the payload executes in the application context, enabling session theft, phishing, and potential account takeover if sensitive users are targeted. A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions. The vulnerable code is: if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']); An unauthenticated attacker can exploit this issue by crafting a malicious URL containing JavaScript payloads. When a victim visits the link, the payload executes in the context of the application within the victim's browser, potentially leading to session hijacking, credential theft, phishing, or account takeover. The issue is fixed in version 3.7, which introduces proper input validation and output encoding to prevent script injection.
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N'}

 cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H'}

Sat, 11 Apr 2026 18:45:00 +0000

Type Values Removed Values Added
Description A pre-authenticated reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type enforcement. The vulnerability is caused by the following code: if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']); This results in arbitrary JavaScript execution in the context of the victim's browser when a crafted URL is visited. An attacker can exploit this issue by sending a malicious link such as: https://TARGET/api/tel/zadarma.php?zd_echo=<script>alert('XSS')</script> When a victim clicks the link, the payload executes in the application context, enabling session theft, phishing, and potential account takeover if sensitive users are targeted.
Weaknesses CWE-79
References
Metrics cvssV2_0

{'score': 6.4, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:N'}

cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N'}

Subscriptions

Rukovoditel Rukovoditel
cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-10T11:43:35.613Z

Reserved: 2026-03-09T18:20:23.398Z

Link: CVE-2026-31845

cve-icon Vulnrichment

Updated: 2026-04-13T17:43:59.274Z

cve-icon NVD

Status : Deferred

Published: 2026-04-11T19:16:28.537

Modified: 2026-08-10T12:17:15.050

Link: CVE-2026-31845

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T00:15:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')