CVE Intelligence
Analysis AI-assisted

CVE-2026-31845: Rukovoditel CRM Reflected XSS in Zadarma API Endpoint

A reflected cross-site scripting weakness (CWE-79) affects Rukovoditel CRM 3.6.4 and earlier in the Zadarma telephony API endpoint. The record states that the 'zd_echo' GET parameter is returned to the HTTP response without adequate sanitization, output encoding, or content-type restrictions. The CNA rates the issue critical with a CVSS 3.1 score of 9.3, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a reflected cross-site scripting weakness (CWE-79) in the Zadarma telephony API endpoint at /api/tel/zadarma.php of Rukovoditel CRM, version 3.6.4 and earlier. According to the record, the value of the 'zd_echo' GET parameter is placed in the HTTP response without sanitization, output encoding, or content-type restrictions.

Impact

  • The CNA assigns a CVSS 3.1 base score of 9.3 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.
  • Per that vector, the attack is remote over the network with low complexity and no privileges required, but it requires user interaction and changes scope, with high confidentiality and integrity impact and no availability impact.
  • A successful reflected XSS would allow script to run in the context of a victim's browser session, which could expose data or actions available to that user in the CRM.

Affected products and versions

  • Rukovoditel CRM 3.6.4 and earlier, as stated in the record description.
  • The record contains no structured affected-version list and no fixed version.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS values in the record (probability 0.00478, percentile 0.39509) are a statistical estimate and do not confirm exploitation.

Remediation and mitigation

  • Check the vendor forum post for the vendor's guidance and any fixed release: Rukovoditel forum.
  • Upgrade to a version beyond 3.6.4 once the vendor confirms it addresses this issue. The record does not identify that version.
  • If the Zadarma integration is not in use, restrict or disable access to the endpoint.
  • Apply defense-in-depth controls such as a reviewed Content-Security-Policy and secure output encoding review in the application.
  • Limit exposure of CRM interfaces to trusted users and avoid opening untrusted links while authenticated to the CRM.

Detection guidance

  • Review web server and application logs for requests to /api/tel/zadarma.php that contain unusually long or script-like values in the 'zd_echo' parameter.
  • Monitor for unexpected outbound connections or session activity from CRM users after such requests.
  • Treat any hits as potential indicators requiring investigation, not as confirmed compromise.

Limitations of the available information

  • The record does not list fixed versions, a complete affected-version range, or vendor-issued CVSS data.
  • The record includes a deferred source status and no ADP or KEV data.
  • Publication date is 2026-04-11 and the EPSS date in the record is 2026-10-13; this discrepancy is not explained by the record.
  • The vendor forum content was not reviewed beyond what the record provides.

Frequently asked questions

Which versions of Rukovoditel CRM are affected?

The record states that version 3.6.4 and earlier are affected. It does not provide a fixed version, so administrators should check the vendor forum for guidance.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog in this record, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.