# Firebase RTDB pharmanetb2b — OPEN DATABASE
# Date: 2026-09-22

## CRITICAL: Firebase RTDB is publicly readable (no auth)

URL: https://pharmanetb2b.firebaseio.com/.json
Status: 200 (public access, no authentication required)

## Data Summary

| Metric | Count |
|--------|-------|
| Total chat conversations | 673 |
| Total messages | 1,694 |
| Unique user IDs | 151 |
| Unique names | 69 |
| Phone numbers in messages | 12 |

## Chat content
PharmaB2B chat between pharmacies and Pharmanet/Pharos admin.
Messages contain:
- Real names of pharmacists (S.Farm., Apt. titles)
- Phone numbers (08xxx format)
- Order inquiries ("Pemesanan apotek belum sampai")
- Customer service discussions
- Username/password requests ("mohon info utk username dan password")

## PII — Real pharmacist names
69 unique names including:
- AFRIJON RAUF, AYU AFRIANA S.Farm.Apt, Akhmad Perdana Kurniawan
- DR. NINA RUKMINASARI, DESMALINDA S.Farm.Apt
- BUDI GUNAWAN, DAVID SEMBIRING, FREDY ISKANDAR
- And many more (full list in JSON file)

## Chat format
```json
{
  "formattedTime": "01:59 PM",
  "imageChat": "",
  "message": "Pemesanan apotek aqlan farma palembang sampai saat ini belum sampai",
  "name": "null",
  "status": "Y",
  "timestamp": 1547794751328,
  "userId": 1003
}
```

## Insecure database marker
Key "2DfjkeJxHJTkdhz5VNVwFJzAeuD": {"id":"insecure-firebase-database"}
This is a marker left by security researchers or automated scanners
indicating the database was found open previously.

## Security implications
1. No authentication required to read all chat data
2. Chat messages contain pharmacist PII (names, phone numbers)
3. Messages reference order numbers and pharmacy operations
4. Some messages contain password/login discussions
5. userIds can be correlated with apps_master.m_user1 table from MySQL

## File saved
/root/ir-assessment/redteam/gitlab_pharmalink_id/firebase_rtdb_pharmanetb2b.json (348 KB)