# CRITICAL — prog2.pharmanet.id/ANDROID/ — Full Source Code Exposed
# Date: 2026-09-23

## Directory listing: http://prog2.pharmanet.id/ANDROID/

### PHP Version: 5.6.37 (EOL since 2019)

### Directory Structure (150+ files):
- connection.php — MySQL connection (executes, hangs on MySQL connect)
- Firebase.php — Firebase config
- getUserPassword.php — password retrieval endpoint
- cobalogin.php — test login page
- updateForgetPassword.php — password reset endpoint
- APIFirebaseFCM.php — Firebase Cloud Messaging
- 150+ PHP files with business logic

### Subdirectories:
- /ANDROID/API/ — API endpoints + connection.php (339 bytes)
- /ANDROID/API/B2B/ — B2B API endpoints
- /ANDROID/admin/ — admin panel with Validate directories (V9-V15)
- /ANDROID/admin/Validate/ to Validate15/ — version-specific validation
- /ANDROID/CronJob/ — cron job scripts
- /ANDROID/FOLDER DUMP/ — unknown content
- /ANDROID/HA/ and HA_V1/ — Head Office API
- /ANDROID/OrderPelapak/ — order management
- /ANDROID/upload/ — uploaded documents
  - KTP/ — National ID card images (with NIK in filename)
  - NPWP/ — Tax ID documents
  - PP/ — unknown
  - SIA/ — Pharmacy license
  - SIPA/ — Pharmacy practice license
  - pelapak/excel/shopee/ — Shopee data per outlet
  - pelapak/excel/tokopedia/ — Tokopedia data per outlet

### PII Exposure
KTP files contain NIK (Indonesian National ID) in filename:
- 0611044604840001-24122019-KTP.jpg
- 0631002200100787-09092019-KTP.jpg
- 0950062906450005-08102020-KTP.jpg
- 0951076905774001-24102019-KTP.jpg

### Version directories (V115-V177, V183) — app version tracking
### Banner directories: BannerETC, BannerNJA, BannerNS, BannerOTC, BannerPE

## Internal URLs from stored procedures
- http://pharmanet.apodoc.id/ — DNS timeout (not externally accessible)
- http://prog2.pharmanet.id/ANDROID/upload/pelapak/ — 200 OK (directory listing)
- https://api.pharmanet.id/PRODUCT_PHOTO/ — 301 redirect to www.api.pharmanet.id (not resolving)
- api.pharmanet.id resolves to 18.138.107.231 (same as sayasehat.id/pharos.co.id)