Description
A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Rukovoditel | Rukovoditel CRM | 3.6.4 | 3.7 |
References
- https://forum.rukovoditel.net/viewtopic.php?p=22499#p22499 third-party-advisory