CVE-2026-31845: Rukovoditel CRM Reflected XSS Vulnerability

CVE-2026-31845 Overview

A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the zd_echo GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions.

An unauthenticated attacker can exploit this issue by crafting a malicious URL containing JavaScript payloads. When a victim visits the link, the payload executes in the context of the application within the victim's browser, potentially leading to session hijacking, credential theft, phishing, or account takeover.

Critical Impact
This reflected XSS vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in victims' browsers, potentially enabling session hijacking, credential theft, and complete account takeover of Rukovoditel CRM users.

Affected Products

Rukovoditel CRM version 3.6.4 and earlier
Zadarma telephony API endpoint (/api/tel/zadarma.php)
All installations with the vulnerable telephony integration enabled

Discovery Timeline

April 11, 2026 - CVE-2026-31845 published to NVD
April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31845

Vulnerability Analysis

This reflected XSS vulnerability stems from insecure handling of user input in the Zadarma telephony API integration. The vulnerable endpoint directly outputs user-controlled data without any form of input validation, output encoding, or Content-Type header restrictions.

The vulnerable code pattern is:

php

if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']);

This code simply echoes whatever value is passed via the zd_echo GET parameter directly into the HTTP response body. Because no sanitization or encoding is applied, and no restrictive Content-Type header is set, the browser interprets any HTML or JavaScript content as executable code.

Root Cause

The root cause of this vulnerability is a complete absence of output encoding and input validation in the zadarma.php API endpoint (CWE-79: Improper Neutralization of Input During Web Page Generation). The code uses exit() to immediately output the raw parameter value, bypassing any framework-level security mechanisms that might otherwise sanitize output. This design pattern directly violates secure coding principles for web applications.

Attack Vector

The vulnerability is exploitable via the network without authentication. An attacker crafts a malicious URL containing JavaScript code in the zd_echo parameter and distributes this URL through phishing emails, social engineering, or malicious websites. When a victim clicks the link while authenticated to Rukovoditel CRM, the JavaScript executes in their browser session with full access to the application context.

Exploitation requires user interaction—specifically, the victim must click the malicious link. Once clicked, the attacker's script can steal session cookies, capture credentials entered into the page, modify displayed content for phishing purposes, or perform actions on behalf of the victim within the CRM application.

Detection Methods for CVE-2026-31845

Indicators of Compromise

HTTP requests to /api/tel/zadarma.php containing the zd_echo parameter with HTML/JavaScript content
Unusual URL patterns in web server logs containing encoded script tags or JavaScript event handlers
Reports from users of unexpected browser behavior or pop-ups when accessing Rukovoditel CRM links
Session anomalies where user actions originate from unexpected IP addresses following link clicks

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block requests containing script tags or JavaScript event handlers in the zd_echo parameter
Configure SIEM alerts for HTTP requests matching patterns like /api/tel/zadarma.php?zd_echo=<script or similar injection attempts
Monitor Content Security Policy (CSP) violation reports if implemented, as they may indicate XSS exploitation attempts
Review web server access logs for abnormal request patterns targeting the vulnerable endpoint

Monitoring Recommendations

Enable detailed logging for all requests to /api/tel/zadarma.php and related telephony API endpoints
Configure real-time alerting for requests containing potential XSS payloads in query string parameters
Monitor for unusual authentication patterns that may indicate session hijacking following XSS exploitation
Implement network-level monitoring for exfiltration attempts to external domains from user sessions

How to Mitigate CVE-2026-31845

Immediate Actions Required

Upgrade Rukovoditel CRM to version 3.7 or later, which includes proper input validation and output encoding
If immediate upgrade is not possible, restrict or disable access to the /api/tel/zadarma.php endpoint
Implement a Web Application Firewall (WAF) to filter malicious requests targeting the vulnerable parameter
Review application logs for evidence of prior exploitation attempts

Patch Information

The vulnerability is fixed in Rukovoditel CRM version 3.7, which introduces proper input validation and output encoding to prevent script injection. Organizations should upgrade to this version or later to remediate the vulnerability. Additional information is available on the Rukovoditel Forum Discussion.

Workarounds

Block access to /api/tel/zadarma.php at the web server or reverse proxy level if the Zadarma telephony integration is not required
Implement a WAF rule to sanitize or reject requests containing script-related content in the zd_echo parameter
Configure Content Security Policy (CSP) headers to restrict inline script execution and mitigate XSS impact
Apply network segmentation to limit exposure of the Rukovoditel CRM application to trusted networks only

bash

# Example: Apache .htaccess rule to block access to vulnerable endpoint
<Location "/api/tel/zadarma.php">
    Require all denied
</Location>

# Example: nginx location block to restrict endpoint access
location /api/tel/zadarma.php {
    deny all;
    return 403;
}