CVE-2026-31845 — AI Deep Analysis Summary

🚨 **Essence**: Reflected XSS in Rukovoditel CRM. The `zd_echo` parameter in the Zadarma phone API endpoint reflects user input directly into the HTTP response without validation.…

🛡️ **Root Cause**: **CWE-79** (Improper Neutralization of Input During Web Page Generation).…

🏢 **Affected**: **Rukovoditel CRM**. 📦 **Versions**: **3.6.4 and earlier**. 🧩 **Component**: Specifically the Zadarma phone API integration endpoint.

💀 **Attacker Capabilities**: Execute arbitrary JavaScript in the victim's browser. 🕵️ **Impact**: Steal admin cookies, redirect users to phishing sites, or perform actions on behalf of the user.…

⚖️ **Exploitation Threshold**: **Low**. 🌐 **Network**: Remote (AV:N). 🔑 **Auth**: None required (PR:N). 🖱️ **User Interaction**: Required (UI:R) - victim must click a crafted link.…

📂 **Public Exploit**: **No**. The `pocs` field is empty. 📢 **Info**: A forum discussion exists (link provided in references), but no verified PoC or wild exploitation code is currently available in the dataset.

🔍 **Self-Check**: Scan for the Zadarma API endpoint. Look for the `zd_echo` parameter in HTTP requests/responses. Use XSS scanners to test if input is reflected without encoding. Check if the version is ≤ 3.6.4.

🛠️ **Official Fix**: **Unknown/Not Provided**. The data does not mention a specific patch version or update. Users must check the vendor's official forum or website for the latest secure version.

🚧 **Workaround**: If no patch is available: 1. **Input Validation**: Sanitize `zd_echo` inputs server-side. 2. **Output Encoding**: Ensure HTML entities are encoded before reflection. 3.…

⚡ **Urgency**: **High**. 📅 **Priority**: Patch immediately. With CVSS score indicating High Confidentiality/Integrity impact and Low complexity, this is a critical risk.…