This vulnerability is a pre-authenticated reflected XSS in Rukovoditel CRM 3.6.4 at the /api/tel/zadarma.php endpoint. The application uses the code snippet 'if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']);' which directly outputs user-supplied input without any sanitization or encoding. An attacker can craft a URL containing malicious JavaScript in the 'zd_echo' parameter, which executes in the context of the victim's browser upon visiting the link. This can lead to theft of session cookies, phishing attacks, or account compromise. The CVSS 4.0 score is 9.3 (critical), reflecting network attack vector, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation level is currently documented.

Successful exploitation results in arbitrary JavaScript execution in the victim's browser within the context of the vulnerable application. This can enable attackers to steal session tokens, perform phishing attacks, or potentially take over user accounts. The vulnerability is exploitable without authentication and requires only that a victim clicks a malicious link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking untrusted links targeting the vulnerable endpoint. Vendors and administrators should monitor for updates and apply patches once released. No official remediation or temporary fix is documented at this time.