CVE-2026-31845 Rukovoditel CVE debrief

Who should care

Organizations operating Rukovoditel CRM instances version 3.6.4 or earlier, particularly those with Zadarma telephony integration enabled. Security teams responsible for web application security, CRM administrators, and developers maintaining Rukovoditel deployments should prioritize patching.

Technical summary

The vulnerability exists in /api/tel/zadarma.php where the zd_echo GET parameter is directly reflected via exit($_GET['zd_echo']) without output encoding. This classic reflected XSS pattern allows attacker-controlled JavaScript execution in the security context of the application. The endpoint appears designed for Zadarma telephony service integration echo/verification functionality. Attack vectors include malicious links distributed via email, social media, or embedded in compromised sites. Successful exploitation requires victim interaction (clicking crafted URL) but grants attacker capabilities limited by same-origin policy of the target application domain.

Defensive priority

critical

Recommended defensive actions

• Upgrade Rukovoditel CRM to version 3.7 or later to obtain the security fix implementing proper input validation and output encoding
• If immediate patching is not feasible, implement Web Application Firewall (WAF) rules to block requests containing suspicious patterns in the zd_echo parameter
• Review access logs for /api/tel/zadarma.php for anomalous requests containing script tags, event handlers, or encoded JavaScript payloads
• Implement Content Security Policy (CSP) headers to mitigate impact of any XSS vulnerabilities
• Conduct security review of similar API endpoints that may reflect user input directly in responses

Evidence notes

Vulnerability confirmed in Rukovoditel CRM ≤3.6.4 via direct code analysis of zadarma.php endpoint. CWE-79 (Improper Neutralization of Input During Web Page Generation) classified. CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, with high impacts to confidentiality, integrity, and availability of victim resources. Fix confirmed in version 3.7.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.