This vulnerability is a reflected XSS in Rukovoditel CRM's Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly outputs the 'zd_echo' GET parameter without sanitization, as shown by the code snippet: if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']);. This allows an attacker to inject and execute arbitrary JavaScript in the context of the victim's browser when they visit a crafted URL. The vulnerability affects version 3.6.4 and earlier and is resolved in version 3.7 by implementing proper input validation and output encoding to prevent script injection.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the victim's browser, which can lead to session hijacking, credential theft, phishing attacks, or account takeover. The vulnerability has a CVSS 4.0 base score of 9.3 (critical), indicating high impact with network attack vector, no privileges required, and user interaction needed.

The vulnerability is fixed in Rukovoditel CRM version 3.7, which introduces proper input validation and output encoding for the 'zd_echo' parameter. Users of affected versions should upgrade to version 3.7 or later to remediate this issue. No other mitigation steps are indicated by the vendor advisory.