Executive brief
Rukovoditel CRM, a project management and customer relationship tool, contains a security flaw in its telephony integration component. An attacker can trick a user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's browser. This could lead to the theft of login credentials, hijacking of active sessions, or full account takeover.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the Zadarma telephony API endpoint (/api/tel/zadarma.php) of Rukovoditel CRM. The root cause is the direct reflection of the 'zd_echo' GET parameter into the HTTP response via an 'exit()' call without sanitization or output encoding. An unauthenticated remote attacker can exploit this by crafting a URL with a malicious JavaScript payload and tricking a victim into visiting it. Successful exploitation allows the execution of arbitrary script in the context of the victim's browser session, potentially leading to session hijacking or credential theft. The vulnerability is fixed in version 3.7.
Affected products
- Rukovoditel Rukovoditel CRM 3.6.4 and earlier
Timeline
- 2026-04-11: advisory: NVD publication date
- 2026-04-11: disclosed: Initial disclosure by TuranSec