Which versions of PHP are affected by CVE-2026-31845?

Rukovoditel CRM 3.6.4 contains a critical reflected XSS vulnerability in its Zadarma telephony API endpoint that allows unauthenticated attackers to execute arbitrary JavaScript in user browsers,…

How to fix or mitigate CVE-2026-31845?

Within 24 hours: Identify all systems running Rukovoditel CRM 3.6.4 and isolate or restrict network access to the Zadarma API endpoint (/zadarma or equivalent). Within 7 days: Contact Rukovoditel vendor for patch timeline; if unavailable, implement Web Application Firewall (WAF) rules to block requests containing 'zd_echo' parameter or deploy reverse proxy filtering. Within 30 days: Upgrade to patched version when released by vendor, or migrate to alternative CRM platform if patch timeline exceeds acceptable risk window. Conduct forced password reset for all CRM users to invalidate potentially compromised sessions.

PHP CVE-2026-31845

Q: What is the CVSS score of CVE-2026-31845?

CVE-2026-31845 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21682 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-04-11 TuranSec

GHSA-hxff-cjjh-cmf4

XSS PHP

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 11, 2026 - 18:53 vuln.today

EUVD ID Assigned

Apr 11, 2026 - 18:45 euvd

EUVD-2026-21682

Analysis Generated

Apr 11, 2026 - 18:45 vuln.today

CVE Published

Apr 11, 2026 - 18:26 nvd

CRITICAL 9.3

DescriptionCVE.org

A pre-authenticated reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type enforcement.

The vulnerability is caused by the following code:

if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']);

This results in arbitrary JavaScript execution in the context of the victim's browser when a crafted URL is visited.

An attacker can exploit this issue by sending a malicious link such as:

https://TARGET/api/tel/zadarma.php?zd_echo=<script>alert('XSS')</script>

When a victim clicks the link, the payload executes in the application context, enabling session theft, phishing, and potential account takeover if sensitive users are targeted.

AnalysisAI

Reflected cross-site scripting (XSS) in Rukovoditel CRM 3.6.4's Zadarma telephony API endpoint allows remote attackers to execute arbitrary JavaScript in victim browsers without authentication. The vulnerability stems from direct reflection of the 'zd_echo' GET parameter without sanitization. With CVSS 9.3 (Critical), changed scope (S:C), and no authentication required (PR:N), this enables session hijacking and account takeover via malicious links. No public exploit identified at time of analysis, though proof-of-concept is trivial given the code-level disclosure. EPSS data not available.

Technical ContextAI

The vulnerability exists in the Zadarma telephony integration API endpoint at /api/tel/zadarma.php within Rukovoditel CRM 3.6.4 (CPE: cpe:2.3:a:rukovoditel:rukovoditel_crm:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a classic reflected XSS pattern in PHP code. The vulnerable code segment 'if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']);' takes user-controlled input from the URL query string and directly outputs it to the HTTP response body without any encoding, sanitization, or Content-Type header enforcement. This allows injection of arbitrary HTML and JavaScript tags that execute in the same-origin context as the CRM application. The pre-authentication nature means the endpoint is accessible without session credentials, significantly lowering the barrier to exploitation. The Changed Scope (S:C) in the CVSS vector indicates impact can extend beyond the vulnerable component to affect other application resources through stolen session tokens or credentials.

RemediationAI

Upgrade to a patched version of Rukovoditel CRM if the vendor has released an update addressing this issue; consult the official vendor forum at https://forum.rukovoditel.net/viewtopic.php?p=22499#p22499 for patch announcements. Released patched version not independently confirmed from available data. If immediate patching is not feasible, implement workarounds including: disable or remove the /api/tel/zadarma.php endpoint if Zadarma telephony integration is not required; implement web application firewall (WAF) rules to block requests containing HTML/JavaScript tags in the 'zd_echo' parameter; apply input validation to reject non-alphanumeric characters in the zd_echo parameter at the web server or reverse proxy layer; implement Content Security Policy (CSP) headers with strict script-src directives to mitigate XSS impact. As a code-level fix, modify the vulnerable PHP file to properly sanitize output using htmlspecialchars() or equivalent encoding functions, and set appropriate Content-Type headers. Monitor access logs for suspicious requests to /api/tel/zadarma.php with script tags or encoded payloads in query parameters.