CVE-2026-31845
Full vulnerability record from the local CVENow database.
Description
A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions.
Severity
CRITICAL
CVSS score
9.3
(v4.0)
Vulnerability status
Deferred
Source identifier
309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Published
2026-04-11 19:16:28.537000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-31845",
"sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"published": "2026-04-11T19:16:28.537",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions."
},
{
"lang": "es",
"value": "Una vulnerabilidad de cross-site scripting (XSS) reflejado existe en Rukovoditel CRM versión 3.6.4 y anteriores en el endpoint de la API de telefonía de Zadarma (/api/tel/zadarma.php). La aplicación refleja directamente la entrada proporcionada por el usuario del parámetro GET ’zd_echo’ en la respuesta HTTP sin sanitización adecuada, codificación de salida o restricciones de tipo de contenido.\n\nEl código vulnerable es:\n\nif (isset(parámetro ’zd_echo’)) exit(parámetro ’zd_echo’);\n\nUn atacante no autenticado puede explotar este problema creando una URL maliciosa que contenga payloads de JavaScript. Cuando una víctima visita el enlace, el payload se ejecuta en el contexto de la aplicación dentro del navegador de la víctima, lo que podría llevar a secuestro de sesión, robo de credenciales, phishing o toma de control de cuenta.\n\nEl problema está solucionado en la versión 3.7, que introduce validación de entrada y codificación de salida adecuadas para prevenir la inyección de scripts."
}
],
"affected": [
{
"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"affectedData": [
{
"vendor": "Rukovoditel",
"product": "Rukovoditel CRM",
"defaultStatus": "unaffected",
"versions": [
{
"version": "3.6.4",
"status": "affected"
},
{
"version": "3.7",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 5.8
}
],
"cvssMetricV2": [
{
"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"baseScore": 6.4,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "NONE"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-13T17:43:52.300455Z",
"id": "CVE-2026-31845",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://forum.rukovoditel.net/viewtopic.php?p=22499#p22499",
"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
}
]
}