Description
A pre-authenticated reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type enforcement. The vulnerability is caused by the following code: if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']); This results in arbitrary JavaScript execution in the context of the victim's browser when a crafted URL is visited. An attacker can exploit this issue by sending a malicious link such as: https://TARGET/api/tel/zadarma.php?zd_echo=<script>alert('XSS')</script> When a victim clicks the link, the payload executes in the application context, enabling session theft, phishing, and potential account takeover if sensitive users are targeted.
INFO
Published Date :
2026-04-11T18:26:46.481Z
Last Modified :
2026-04-11T18:42:30.728Z
Source :
TuranSec
AFFECTED PRODUCTS
The following products are affected by CVE-2026-31845 vulnerability.
No data.
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-31845.
