ZAP Scanning Report

Summary of Alerts

Risk LevelNumber of Alerts
High0
Medium2
Low5
Informational4

Alert Detail

Medium (Medium)Directory Browsing
Description

It is possible to view the directory listing. Directory listing may reveal hidden scripts, include files, backup source files, etc. which can be accessed to read sensitive information.

URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/datatables/
MethodGET
AttackParent Directory
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/bootstrap/css/
MethodGET
AttackParent Directory
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/bootstrap-datepicker/
MethodGET
AttackParent Directory
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/bootstrap/
MethodGET
AttackParent Directory
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/bootstrap-datepicker/js/
MethodGET
AttackParent Directory
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/jquery/
MethodGET
AttackParent Directory
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/bootstrap-datepicker/css/
MethodGET
AttackParent Directory
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/bootstrap/js/
MethodGET
AttackParent Directory
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/select2/
MethodGET
AttackParent Directory
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/datatables/js/
MethodGET
AttackParent Directory
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/datatables/css/
MethodGET
AttackParent Directory
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/plugins/chartjs/
MethodGET
AttackParent Directory
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/bootstrap/fonts/
MethodGET
AttackParent Directory
Instances13
Solution

Disable directory browsing. If this is required, make sure the listed files does not induce risks.

Reference

http://httpd.apache.org/docs/mod/core.html#options

http://alamo.satlug.org/pipermail/satlug/2002-February/000053.html

CWE Id548
WASC Id48
Source ID1
Medium (Medium)X-Frame-Options Header Not Set
Description

X-Frame-Options header is not included in the HTTP response to protect against 'ClickJacking' attacks.

URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/rajal/12-profil/5-ppid?print=1&tmpl=component
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/rawat-inap/9-berita-terkini/31-vaksin-covid-19?print=1&tmpl=component
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/ikm/9-berita-terkini/31-vaksin-covid-19?print=1&tmpl=component
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/9-berita-terkini/21-alur-pendaftaran-pasien
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program/10-indikator-kinerja-utama
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program/16-cascading
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/9-berita-terkini?start=5
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php?option=com_users&view=reset
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program/15-ringkasan-dpa-2020-rsud-kabupaten-sumedang
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/igd/9-berita-terkini/30-bantuan-rapid-test-antigen-dan-apd-ke-rsud-sumedang?print=1&tmpl=component
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/rawat-inap
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/9-berita-terkini/8-alurpasien
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/ikm/9-berita-terkini/21-alur-pendaftaran-pasien
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/rajal
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program/11-indikator-kinerja-individu?print=1&tmpl=component
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program
MethodPOST
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program/18-survey-kepuasan-masyarakat?print=1&tmpl=component
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program/14-renja
MethodGET
ParameterX-Frame-Options
URLhttp://rsud.sumedangkab.go.id/index.php/9-berita-terkini/30-bantuan-rapid-test-antigen-dan-apd-ke-rsud-sumedang?print=1&tmpl=component
MethodGET
ParameterX-Frame-Options
Instances102
Solution

Most modern Web browsers support the X-Frame-Options HTTP header. Ensure it's set on all web pages returned by your site (if you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. ALLOW-FROM allows specific websites to frame the web page in supported web browsers).

Reference

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

CWE Id16
WASC Id15
Source ID3
Low (Medium)Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
Description

The web/application server is leaking information via one or more "X-Powered-By" HTTP response headers. Access to such information may facilitate attackers identifying other frameworks/components your web application is reliant upon and the vulnerabilities such components may be subject to.

URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/igd/9-berita-terkini
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/rawat-inap/9-berita-terkini?format=feed&type=atom
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/daftaronline/admin/dashboard
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php/9-berita-terkini?amp;type=atom&format=feed
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php/component/users/?Itemid=101&task=remind.remind
MethodPOST
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/rawat-inap/9-berita-terkini/31-vaksin-covid-19
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php?amp;format=feed&type=atom&type=rss
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php/ikm/9-berita-terkini/31-vaksin-covid-19
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php/9-berita-terkini
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php/ikm/9-berita-terkini?amp;type=atom&format=feed
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/igd/9-berita-terkini/31-vaksin-covid-19?print=1&tmpl=component
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php/ikm/9-berita-terkini/8-alurpasien
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program/16-cascading?print=1&tmpl=component
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php/profil
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/rawat-inap/9-berita-terkini/30-bantuan-rapid-test-antigen-dan-apd-ke-rsud-sumedang?print=1&tmpl=component
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php/mutu-rs
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/rajal?print=1&tmpl=component
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php?option=com_users&view=remind
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/igd/9-berita-terkini/21-alur-pendaftaran-pasien
MethodGET
EvidenceX-Powered-By: PHP/5.6.3
Instances141
Solution

Ensure that your web server, application server, load balancer, etc. is configured to suppress "X-Powered-By" headers.

Reference

http://blogs.msdn.com/b/varunm/archive/2013/04/23/remove-unwanted-http-response-headers.aspx

http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html

CWE Id200
WASC Id13
Source ID3
Low (Medium)X-Content-Type-Options Header Missing
Description

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

URLhttp://rsud.sumedangkab.go.id/daftarOnline/assets/datatables/css/dataTables.bootstrap.css
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/media/system/js/caption.js?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/frameworks/font-awesome/css/font-awesome.min.css
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/jquery/jquery-ui.css
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/daftarOnline/assets/frameworks/adminlte/css/adminlte.min.css
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/rajal/12-profil?amp;type=rss&format=feed
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/media/system/js/punycode.js?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program/11-indikator-kinerja-individu?print=1&tmpl=component
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/images/web1.png
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/plugins/chartjs/Chart.min.js
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/media/jui/js/chosen.jquery.min.js?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/frameworks/adminlte/css/font.css
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/media/jui/js/jquery-migrate.min.js?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/index.php/9-berita-terkini?start=5
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/daftarOnline/assets/jquery/jquery-2.1.4.min.js
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/rajal/12-profil?format=feed&type=rss
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/frameworks/adminlte/js/adminlte.min.js
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program/10-indikator-kinerja-utama
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/modules/mod_ariextmenu/mod_ariextmenu/js/css/menu.min.css
MethodGET
ParameterX-Content-Type-Options
URLhttp://rsud.sumedangkab.go.id/index.php/9-berita-terkini?amp;format=feed&type=rss
MethodGET
ParameterX-Content-Type-Options
Instances228
Solution

Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.

If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.

Other information

This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.

At "High" threshold this scan rule will not alert on client or server error responses.

Reference

http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx

https://owasp.org/www-community/Security_Headers

CWE Id16
WASC Id15
Source ID3
Low (Medium)Cross-Domain JavaScript Source File Inclusion
Description

The page includes one or more script files from a third-party domain.

URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program/14-renja
MethodGET
Parameterhttp://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js
Evidence<script src="http://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program
MethodGET
Parameterhttp://html5shim.googlecode.com/svn/trunk/html5.js
Evidence<script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program/15-ringkasan-dpa-2020-rsud-kabupaten-sumedang
MethodGET
Parameterhttp://html5shim.googlecode.com/svn/trunk/html5.js
Evidence<script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program/10-indikator-kinerja-utama
MethodGET
Parameterhttp://html5shim.googlecode.com/svn/trunk/html5.js
Evidence<script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program
MethodGET
Parameterhttp://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js
Evidence<script src="http://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/ikm/9-berita-terkini
MethodGET
Parameterhttp://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js
Evidence<script src="http://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php?option=com_users&view=reset
MethodGET
Parameterhttps://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6587448577702669
Evidence<script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6587448577702669" crossorigin="anonymous"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/component/users/
MethodGET
Parameterhttps://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6587448577702669
Evidence<script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6587448577702669" crossorigin="anonymous"></script>
URLhttp://rsud.sumedangkab.go.id/
MethodGET
Parameterhttps://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6587448577702669
Evidence<script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6587448577702669" crossorigin="anonymous"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/igd
MethodGET
Parameterhttp://html5shim.googlecode.com/svn/trunk/html5.js
Evidence<script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/rawat-inap/9-berita-terkini/21-alur-pendaftaran-pasien
MethodGET
Parameterhttp://html5shim.googlecode.com/svn/trunk/html5.js
Evidence<script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/rawat-inap/9-berita-terkini/30-bantuan-rapid-test-antigen-dan-apd-ke-rsud-sumedang
MethodGET
Parameterhttp://html5shim.googlecode.com/svn/trunk/html5.js
Evidence<script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program?start=10
MethodGET
Parameterhttp://html5shim.googlecode.com/svn/trunk/html5.js
Evidence<script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/mutu-rs?amp;format=feed&amp;type=rss
MethodGET
Parameterhttp://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js
Evidence<script src="http://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/mutu-rs?amp;format=feed&amp;type=atom&amp;type=rss
MethodGET
Parameterhttp://html5shim.googlecode.com/svn/trunk/html5.js
Evidence<script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program/18-survey-kepuasan-masyarakat
MethodGET
Parameterhttp://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js
Evidence<script src="http://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program/15-ringkasan-dpa-2020-rsud-kabupaten-sumedang
MethodGET
Parameterhttp://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js
Evidence<script src="http://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program/10-indikator-kinerja-utama
MethodGET
Parameterhttp://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js
Evidence<script src="http://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/igd/9-berita-terkini/21-alur-pendaftaran-pasien
MethodGET
Parameterhttp://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js
Evidence<script src="http://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js"></script>
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/rawat-inap/9-berita-terkini/21-alur-pendaftaran-pasien
MethodGET
Parameterhttp://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js
Evidence<script src="http://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js"></script>
Instances97
Solution

Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.

Reference

CWE Id829
WASC Id15
Source ID3
Low (Medium)Absence of Anti-CSRF Tokens
Description

No Anti-CSRF tokens were found in a HTML submission form.

A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.

CSRF attacks are effective in a number of situations, including:

* The victim has an active session on the target site.

* The victim is authenticated via HTTP auth on the target site.

* The victim is on the same local network as the target site.

CSRF has primarily been used to perform an action against a target site using the victim's privileges, but recent techniques have been discovered to disclose information by gaining access to the response. The risk of information disclosure is dramatically increased when the target site is vulnerable to XSS, because XSS can be used as a platform for CSRF, allowing the attack to operate within the bounds of the same-origin policy.

URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program?amp;format=feed&amp;type=atom&amp;type=rss
MethodGET
Evidence<form action="http://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program?amp;format=feed&amp;type=atom&amp;type=rss" method="post" name="adminForm" id="adminForm">
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program?start=10
MethodGET
Evidence<form action="http://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program?start=10" method="post" name="adminForm" id="adminForm">
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program
MethodPOST
Evidence<form action="http://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program" method="post" name="adminForm" id="adminForm">
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program?amp;format=feed&amp;type=rss
MethodGET
Evidence<form action="http://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program?amp;format=feed&amp;type=rss" method="post" name="adminForm" id="adminForm">
URLhttp://rsud.sumedangkab.go.id/index.php?option=com_users&view=reset
MethodGET
Evidence<form id="user-registration" action="/index.php/component/users/?task=reset.request&amp;Itemid=101" method="post" class="form-validate form-horizontal well">
URLhttp://rsud.sumedangkab.go.id/index.php/component/users/
MethodGET
Evidence<form action="/index.php/component/users/?task=user.login&amp;Itemid=101" method="post" class="form-validate form-horizontal well">
URLhttp://rsud.sumedangkab.go.id/administrator/index.php
MethodPOST
Evidence<form action="/administrator/index.php" method="post" id="form-login" class="form-inline">
URLhttp://rsud.sumedangkab.go.id/index.php?option=com_users&view=remind
MethodGET
Evidence<form id="user-registration" action="/index.php/component/users/?task=remind.remind&amp;Itemid=101" method="post" class="form-validate form-horizontal well">
URLhttp://rsud.sumedangkab.go.id/index.php/component/users/?Itemid=101&view=remind
MethodGET
Evidence<form id="user-registration" action="/index.php/component/users/?task=remind.remind&amp;Itemid=101" method="post" class="form-validate form-horizontal well">
URLhttp://rsud.sumedangkab.go.id/daftarOnline/
MethodGET
Evidence<form class="form-horizontal" method="post" role="form">
URLhttp://rsud.sumedangkab.go.id/administrator/
MethodGET
Evidence<form action="/administrator/index.php" method="post" id="form-login" class="form-inline">
URLhttp://rsud.sumedangkab.go.id/daftaronline/
MethodGET
Evidence<form class="form-horizontal" method="post" role="form">
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program
MethodGET
Evidence<form action="http://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program" method="post" name="adminForm" id="adminForm">
URLhttp://rsud.sumedangkab.go.id/daftarOnline/daftar_online
MethodGET
Evidence<form class="form-horizontal" method="post" role="form">
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program?start=10
MethodPOST
Evidence<form action="http://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program?start=10" method="post" name="adminForm" id="adminForm">
Instances15
Solution

Phase: Architecture and Design

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

For example, use anti-CSRF packages such as the OWASP CSRFGuard.

Phase: Implementation

Ensure that your application is free of cross-site scripting issues, because most CSRF defenses can be bypassed using attacker-controlled script.

Phase: Architecture and Design

Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330).

Note that this can be bypassed using XSS.

Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

Note that this can be bypassed using XSS.

Use the ESAPI Session Management control.

This control includes a component for CSRF.

Do not use the GET method for any request that triggers a state change.

Phase: Implementation

Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Other information

No known Anti-CSRF token [anticsrf, CSRFToken, __RequestVerificationToken, csrfmiddlewaretoken, authenticity_token, OWASP_CSRFTOKEN, anoncsrf, csrf_token, _csrf, _csrfSecret] was found in the following HTML form: [Form 1: "filter_order" "filter_order_Dir" "limitstart" ].

Reference

http://projects.webappsec.org/Cross-Site-Request-Forgery

http://cwe.mitre.org/data/definitions/352.html

CWE Id352
WASC Id9
Source ID3
Low (Medium)Cookie Without SameSite Attribute
Description

A cookie has been set without the SameSite attribute, which means that the cookie can be sent as a result of a 'cross-site' request. The SameSite attribute is an effective counter measure to cross-site request forgery, cross-site script inclusion, and timing attacks.

URLhttp://rsud.sumedangkab.go.id/administrator/
MethodGET
Parameterb18f7f6eb2ef6b59f66062689bb1b8d0
EvidenceSet-Cookie: b18f7f6eb2ef6b59f66062689bb1b8d0
URLhttp://rsud.sumedangkab.go.id/
MethodGET
Parameter3f2337ce6adea346b9dcb87f94bb3c22
EvidenceSet-Cookie: 3f2337ce6adea346b9dcb87f94bb3c22
URLhttp://rsud.sumedangkab.go.id/index.php?option=com_users&view=remind
MethodGET
Parameter3f2337ce6adea346b9dcb87f94bb3c22
EvidenceSet-Cookie: 3f2337ce6adea346b9dcb87f94bb3c22
Instances3
Solution

Ensure that the SameSite attribute is set to either 'lax' or ideally 'strict' for all cookies.

Reference

https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site

CWE Id16
WASC Id13
Source ID3
Informational (Medium)Information Disclosure - Suspicious Comments
Description

The response appears to contain suspicious comments which may help an attacker. Note: Matches made within script blocks or files are against the entire content not only comments.

URLhttp://rsud.sumedangkab.go.id/index.php/mutu-rs
MethodGET
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program?start=10
MethodPOST
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program?start=10
MethodGET
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program?amp;format=feed&amp;type=rss
MethodGET
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program
MethodPOST
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program
MethodGET
URLhttp://rsud.sumedangkab.go.id/index.php/informasi-publikasi/program?amp;format=feed&amp;type=atom&amp;type=rss
MethodGET
URLhttp://rsud.sumedangkab.go.id/index.php/mutu-rs?amp;format=feed&amp;type=rss
MethodGET
URLhttp://rsud.sumedangkab.go.id/index.php/mutu-rs?amp;format=feed&amp;type=atom&amp;type=rss
MethodGET
Instances9
Solution

Remove all comments that return information that may help an attacker and fix any underlying problems they refer to.

Other information

The following comment/snippet was identified via the pattern: \bTODO\b

<!-- @TODO add hidden inputs -->

Reference

CWE Id200
WASC Id13
Source ID3
Informational (Medium)Content-Type Header Missing
Description

The Content-Type header was either missing or empty.

URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/frameworks/font-awesome/fonts/fontawesome-webfont.woff2?v=4.6.3
MethodGET
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/bootstrap/fonts/glyphicons-halflings-regular.woff2
MethodGET
Instances2
Solution

Ensure each page is setting the specific and appropriate content-type value for the content being delivered.

Reference

http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx

CWE Id345
WASC Id12
Source ID3
Informational (Low)Timestamp Disclosure - Unix
Description

A timestamp was disclosed by the application/web server - Unix

URLhttp://rsud.sumedangkab.go.id/administrator/templates/isis/css/template.css?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Evidence60079934
URLhttp://rsud.sumedangkab.go.id/templates/protostar/css/template.css?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Evidence404255317
URLhttp://rsud.sumedangkab.go.id/index.php/9-berita-terkini/21-alur-pendaftaran-pasien?print=1&tmpl=component
MethodGET
Evidence20190325
URLhttp://rsud.sumedangkab.go.id/administrator/templates/isis/css/template.css?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Evidence425531911
URLhttp://rsud.sumedangkab.go.id/templates/protostar/css/template.css?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Evidence063829782
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/rawat-inap/9-berita-terkini/21-alur-pendaftaran-pasien
MethodGET
Evidence20190325
URLhttp://rsud.sumedangkab.go.id/administrator/templates/isis/css/template.css?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Evidence56353591
URLhttp://rsud.sumedangkab.go.id/templates/protostar/css/template.css?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Evidence638297871
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/jquery/jquery-ui.js
MethodGET
Evidence0123456789
URLhttp://rsud.sumedangkab.go.id/administrator/templates/isis/css/template.css?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Evidence27483249
URLhttp://rsud.sumedangkab.go.id/index.php/9-berita-terkini/8-alurpasien?print=1&tmpl=component
MethodGET
Evidence20190325
URLhttp://rsud.sumedangkab.go.id/administrator/templates/isis/css/template.css?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Evidence74791348
URLhttp://rsud.sumedangkab.go.id/
MethodGET
Evidence20190325
URLhttp://rsud.sumedangkab.go.id/administrator/templates/isis/css/template.css?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Evidence70923945
URLhttp://rsud.sumedangkab.go.id/templates/protostar/css/template.css?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Evidence595744673
URLhttp://rsud.sumedangkab.go.id/administrator/templates/isis/css/template.css?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Evidence58422476
URLhttp://rsud.sumedangkab.go.id/administrator/templates/isis/css/template.css?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Evidence30939227
URLhttp://rsud.sumedangkab.go.id/templates/protostar/css/template.css?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Evidence680851059
URLhttp://rsud.sumedangkab.go.id/administrator/templates/isis/css/template.css?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Evidence09251205
URLhttp://rsud.sumedangkab.go.id/administrator/templates/isis/css/template.css?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Evidence50828729
Instances181
Solution

Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.

Other information

60079934, which evaluates to: 1971-11-27 15:52:14

Reference

http://projects.webappsec.org/w/page/13246936/Information%20Leakage

CWE Id200
WASC Id13
Source ID3
Informational (Low)Information Disclosure - Suspicious Comments
Description

The response appears to contain suspicious comments which may help an attacker. Note: Matches made within script blocks or files are against the entire content not only comments.

URLhttp://rsud.sumedangkab.go.id/index.php?option=com_users&view=reset
MethodGET
URLhttp://rsud.sumedangkab.go.id/daftarOnline/assets/datatables/js/dataTables.bootstrap.js
MethodGET
URLhttp://rsud.sumedangkab.go.id/daftarOnline/assets/plugins/html5shiv/html5shiv.min.js
MethodGET
URLhttp://rsud.sumedangkab.go.id/media/jui/js/bootstrap.min.js?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
URLhttp://rsud.sumedangkab.go.id/media/system/js/caption.js?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
URLhttp://rsud.sumedangkab.go.id/index.php/component/users/?Itemid=101&view=remind
MethodGET
URLhttp://rsud.sumedangkab.go.id/daftarOnline/assets/select2/select2.min.js
MethodGET
URLhttp://rsud.sumedangkab.go.id/templates/protostar/js/template.js?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/plugins/html5shiv/html5shiv.min.js
MethodGET
URLhttp://rsud.sumedangkab.go.id/daftarOnline/
MethodGET
URLhttp://rsud.sumedangkab.go.id/administrator/
MethodGET
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/datatables/js/dataTables.bootstrap.js
MethodGET
URLhttp://rsud.sumedangkab.go.id/index.php/pelayanan/rajal/12-profil/5-ppid
MethodGET
URLhttp://rsud.sumedangkab.go.id/daftarOnline/daftar_online
MethodGET
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/jquery/jquery-2.1.4.min.js
MethodGET
URLhttp://rsud.sumedangkab.go.id/daftaronline/assets/jquery/jquery-ui.js
MethodGET
URLhttp://rsud.sumedangkab.go.id/daftarOnline/assets/jquery/jquery-ui.js
MethodGET
URLhttp://rsud.sumedangkab.go.id/index.php
MethodGET
URLhttp://rsud.sumedangkab.go.id/index.php/profil
MethodGET
URLhttp://rsud.sumedangkab.go.id/media/jui/js/chosen.jquery.min.js?c829a405820d7b03d5cd90f0e080f0c0
MethodGET
Instances56
Solution

Remove all comments that return information that may help an attacker and fix any underlying problems they refer to.

Other information

The following comment/snippet was identified via the pattern: \bSELECT\b

<script>

jQuery(function($){ initPopovers(); $("body").on("subform-row-add", initPopovers); function initPopovers (event, container) { $(container || document).find(".hasPopover").popover({"html": true,"trigger": "hover focus","container": "body"});} }); ;(function() { var _menuInit = function() { new Ext.ux.Menu("ariext91", {"transitionDuration":0.2}); Ext.get("ariext91").select(".ux-menu-sub").removeClass("ux-menu-init-hidden"); }; if (!Ext.isIE || typeof(MooTools) == "undefined" || typeof(MooTools.More) == "undefined") Ext.onReady(_menuInit); else window.addEvent("domready", _menuInit); })();

</script>

Reference

CWE Id200
WASC Id13
Source ID3