Free Essay

Information Technology

In:

Submitted By des2020
Words 8394
Pages 34
Itrust Website Audit
11 November ,
2014

2014 CWE/SANS Top 25 Most Dangerous
Software Errors
~ compliance report ~

Generated by Acunetix WVS Reporter (v9.5 Build 20140505)

2015 CWE/SANS Top 25 Most Dangerous Software Errors compliance report
Description
The 2015 CWE/SANS Top 25 Most Dangerous Software Errors is a list of the most widespread and critical errors that can lead to serious vulnerabilities in software. They are often easy to find, and easy to exploit. They are dangerous because they will frequently allow attackers to completely take over the software, steal data, or prevent the software from working at all.
The Top 25 list is a tool for education and awareness to help programmers to prevent the kinds of vulnerabilities that plague the software industry, by identifying and avoiding all-too-common mistakes that occur before software is even shipped. Software customers can use the same list to help them to ask for more secure software. Researchers in software security can use the Top 25 to focus on a narrow but important subset of all known security weaknesses.
Finally, software managers and CIOs can use the Top 25 list as a measuring stick of progress in their efforts to secure their software.
The list is the result of collaboration between the SANS Institute, MITRE, and many top software security experts in the
US and Europe. It leverages experiences in the development of the SANS Top 20 attack vectors
(http://www.sans.org/top20/) and MITRE's Common Weakness Enumeration (CWE) (http://cwe.mitre.org/). MITRE maintains the CWE web site, with the support of the US Department of Homeland Security's National Cyber Security Division, presenting detailed descriptions of the top 25 programming errors along with authoritative guidance for mitigating and avoiding them. The CWE site contains data on more than 800 programming errors, design errors, and architecture errors that can lead to exploitable vulnerabilities.

Disclaimer
This document or any of its content cannot account for, or be included in any form of legal advice. The outcome of a vulnerability scan (or security evaluation) should be utilized to ensure that diligent measures are taken to lower the risk of potential exploits carried out to compromise data.
Legal advice must be supplied according to its legal context. All laws and the environments in which they are applied, are constantly changed and revised. Therefore no information provided in this document may ever be used as an alternative to a qualified legal body or representative.
This document was generated using information provided in "2010 CWE/SANS Top 25 Most Dangerous Software
Errors", that can be found at http://cwe.mitre.org/top25/.

Scan
URL
Scan date
Duration
Profile

agile.csc.ncsu.edu/iTrust/wiki/doku.php?id=start
28-Mar-15 09:44:49
13 minutes, 26 seconds
Default

Compliance at a Glance
This section of the report is a summary and lists the number of alerts found according to individual compliance categories. -

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (1)
Total number of alerts in this category: 154
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (2)
No alerts in this category
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (3)
No alerts in this category

Acunetix Website Audit

2

-

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4)
Total number of alerts in this category: 80
Missing Authentication for Critical Function (5)
No alerts in this category
Improper Access Control (Authorization) (6)
No alerts in this category
Use of Hard-coded Credentials (7)
No alerts in this category
Missing Encryption of Sensitive Data (8)
Total number of alerts in this category: 1
Unrestricted Upload of File with Dangerous Type (9)
No alerts in this category
Reliance on Untrusted Inputs in a Security Decision (10)
No alerts in this category
Execution with Unnecessary Privileges (11)
No alerts in this category
Cross-Site Request Forgery (CSRF) (12)
Total number of alerts in this category: 19
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (13)
Total number of alerts in this category: 4
Download of Code Without Integrity Check (14)
No alerts in this category
Incorrect Authorization (15)
No alerts in this category
Inclusion of Functionality from Untrusted Control Sphere (16)
Total number of alerts in this category: 40
Incorrect Permission Assignment for Critical Resource (17)
Total number of alerts in this category: 92
Use of Potentially Dangerous Function (18)
No alerts in this category
Use of a Broken or Risky Cryptographic Algorithm (19)
No alerts in this category
Incorrect Calculation of Buffer Size (20)
No alerts in this category
Improper Restriction of Excessive Authentication Attempts (21)
No alerts in this category
URL Redirection to Untrusted Site ('Open Redirect') (22)
Total number of alerts in this category: 1
Uncontrolled Format String (23)
No alerts in this category
Integer Overflow or Wraparound (24)
No alerts in this category
Use of a One-Way Hash without a Salt (25)
No alerts in this category

Acunetix Website Audit

3

Compliance According to Categories: A Detailed Report
This section is a detailed report that explains each vulnerability found according to individual compliance categories.

(1) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
These days, it seems as if software is all about the data: getting it into the database, pulling it from the database, massaging it into information, and sending it elsewhere for fun and profit. If attackers can influence the SQL that you use to communicate with your database, then suddenly all your fun and profit belongs to them. If you use SQL queries in security controls such as authentication, attackers could alter the logic of those queries to bypass security. They could modify the queries to steal, corrupt, or otherwise change your underlying data. They'll even steal data one byte at a time if they have to, and they have the patience and know-how to do so.
Total number of alerts in this category: 154
Alerts in this category
Blind SQL Injection
This script is possibly vulnerable to SQL Injection attacks.
SQL injection is a vulnerability that allows an attacker to alter back-end SQL statements by manipulating the user input. An SQL injection occurs when web applications accept user input that is directly placed into a SQL statement and doesn't properly filter out dangerous characters.
This is one of the most common application layer attacks currently being used on the Internet. Despite the fact that it is relatively easy to protect against, there is a large number of web applications vulnerable.
CVSS

Base Score: 6.8

CWE

- Access Vector: Network
- Access Complexity: Medium
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: Partial
- Availability Impact: Partial
CWE-89

Affected item
Affected parameter
Variants

/ login 2

Affected item
Affected parameter
Variants

/AJAX/infopatient.php id 2

Affected item
Affected parameter
Variants

/AJAX/infocateg.php id 2

Affected item
Affected parameter
Variants

/AJAX/infotitle.php id 2

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/patients.php patient 2
/patients.php
login
2

Affected item
Affected parameter
Variants
Affected item

/cart.php addcart 4
/cart.php

Acunetix Website Audit

4

Affected parameter
Variants

login
2

Affected item
Affected parameter
Variants

/guestbook.php login 2

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/listdiagnosis.php patient 2
/listdiagnosis.php
cat
4
/listdiagnosis.php login 2

Affected item
Affected parameter
Variants

/Mod_Rewrite_physician/contact.php id 2

Affected item
Affected parameter
Variants

/Mod_Rewrite_physician/details.php id 2

Affected item
Affected parameter
Variants

/Mod_Rewrite_physician/clinic.php id 2

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/product.php login 2
/product.php
pic
2

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/search.php login 2
/search.php
searchFor
4
/search.php test 4

Affected item
Affected parameter
Variants

/secured/newuser.php uuname 2

Affected item
Affected parameter
Variants

/sendcommand.php cart_id 4

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/userinfo.php pass 2
/userinfo.php
uaddress
4

Acunetix Website Audit

5

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/userinfo.php ucc 4
/userinfo.php
uemail
2
/userinfo.php uphone 2
/userinfo.php
urname
2

SQL injection (verified)
This script is possibly vulnerable to SQL Injection attacks.
SQL injection is a vulnerability that allows an attacker to alter back-end SQL statements by manipulating the user input. An SQL injection occurs when web applications accept user input that is directly placed into a SQL statement and doesn't properly filter out dangerous characters.
This is one of the most common application layer attacks currently being used on the Internet. Despite the fact that it is relatively easy to protect against, there is a large number of web applications vulnerable.
CVSS

Base Score: 6.8

CWE

- Access Vector: Network
- Access Complexity: Medium
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: Partial
- Availability Impact: Partial
CWE-89

Affected item
Affected parameter
Variants

/ login 2

Affected item
Affected parameter
Variants

/AJAX/infopatient.php id 2

Affected item
Affected parameter
Variants

/AJAX/infocateg.php id 2

Affected item
Affected parameter
Variants

/AJAX/infotitle.php id 2

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/patients.php patient 2
/patients.php
login
2

Affected item
Affected parameter
Variants
Affected item
Affected parameter

/cart.php addcart 6
/cart.php
del

Acunetix Website Audit

6

Variants
Affected item
Affected parameter
Variants

2
/homre.php
login
2

Affected item
Affected parameter
Variants

/guestbook.php login 2

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/listdiagnosis.php patient 2
/listdiagnosis.php
cat
4
/listdiagnosis.php login 2

Affected item
Affected parameter
Variants

/Mod_Rewrite_physician/buy.php id 2

Affected item
Affected parameter
Variants

/Mod_Rewrite_physician/details.php id 2

Affected item
Affected parameter
Variants

/Mod_Rewrite_physician/rate.php id 2

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/product.php login 2
/product.php
pic
2

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/search.php login 2
/search.php
searchFor
4
/search.php test 4

Affected item
Affected parameter
Variants

/secured/newuser.php uuname 2

Affected item
Affected parameter
Variants

/sendcommand.php cart_id 4

Affected item
Affected parameter
Variants
Affected item

/userinfo.php login 2
/userinfo.php

Acunetix Website Audit

7

Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

pass
2
/userinfo.php uaddress 4
/userinfo.php
ucc
4
/userinfo.php uemail 4
/userinfo.php
uname
2
/userinfo.php uphone 4
/userinfo.php
urname
4

(2) Improper Neutralization of Special Elements used in an OS Command ('OS Command
Injection')
Your software is often the bridge between an outsider on the network and the internals of your operating system. When you invoke another program on the operating system, but you allow untrusted inputs to be fed into the command string that you generate for executing that program, then you are inviting attackers to cross that bridge into a land of riches by executing their own commands instead of yours.
No alerts in this category.

(3) Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Buffer overflows are Mother Nature's little reminder of that law of physics that says: if you try to put more stuff into a container than it can hold, you're going to make a mess. The scourge of C applications for decades, buffer overflows have been remarkably resistant to elimination. However, copying an untrusted input without checking the size of that input is the simplest error to make in a time when there are much more interesting mistakes to avoid. That's why this type of buffer overflow is often referred to as "classic." It's decades old, and it's typically one of the first things you learn about in
Secure Programming 101.
No alerts in this category.

(4) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) is one of the most prevalent, obstinate, and dangerous vulnerabilities in web applications. It's pretty much inevitable when you combine the stateless nature of HTTP, the mixture of data and script in HTML, lots of data passing between web sites, diverse encoding schemes, and feature-rich web browsers. If you're not careful, attackers can inject Javascript or other browser-executable content into a web page that your application generates. Your web page is then accessed by other users, whose browsers execute that malicious script as if it came from you (because, after all, it
*did* come from you). Suddenly, your web site is serving code that you didn't write. The attacker can use a variety of techniques to get the input directly into your server, or use an unwitting victim as the middle man in a technical version of the "why do you keep hitting yourself?" game.
Total number of alerts in this category: 80
Alerts in this category

Acunetix Website Audit

8

Cross site scripting
This script is possibly vulnerable to Cross Site Scripting (XSS) attacks.
Cross site scripting (also referred to as XSS) is a vulnerability that allows an attacker to send malicious code (usually in the form of Javascript) to another user. Because a browser cannot know if the script should be trusted or not, it will execute the script in the user context allowing the attacker to access any cookies or session tokens retained by the browser. CVSS

Base Score: 4.4

CWE

- Access Vector: Network
- Access Complexity: Medium
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
CWE-79

Affected item
Affected parameter
Variants

/showimage.php file 4

Cross site scripting (verified)
This script is possibly vulnerable to Cross Site Scripting (XSS) attacks.
Cross site scripting (also referred to as XSS) is a vulnerability that allows an attacker to send malicious code (usually in the form of Javascript) to another user. Because a browser cannot know if the script should be trusted or not, it will execute the script in the user context allowing the attacker to access any cookies or session tokens retained by the browser. CVSS

Base Score: 4.4

CWE

- Access Vector: Network
- Access Complexity: Medium
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
CWE-79

Affected item
Affected parameter
Variants

/404.php

Affected item
Affected parameter
Variants

/AJAX/showxml.php mycookie 2

Affected item
Affected parameter
Variants

/comment.php name 2

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/guestbook.php name 4
/guestbook.php
text
4

Affected item
Affected parameter
Variants

/hpp/ pp 6

Affected item

/hpp/index.php

2

Acunetix Website Audit

9

Affected parameter
Variants

pp
6

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/hpp/params.php p 4
/hpp/params.php
pp
4

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/listdiagnosis.php patient 2
/listdiagnosis.php
cat
4

Affected item
Affected parameter
Variants

/search.php searchFor 4

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/secured/newuser.php uaddress 2
/secured/newuser.php
ucc
2
/secured/newuser.php uemail 2
/secured/newuser.php
uphone
2
/secured/newuser.php urname 2
/secured/newuser.php
uuname
2

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/userinfo.php uaddress 4
/userinfo.php
ucc
4
/userinfo.php uemail 4
/userinfo.php
uphone
4
/userinfo.php urname 4

Acunetix Website Audit

10

(5) Missing Authentication for Critical Function
In countless action movies, the villain breaks into a high-security building by crawling through heating ducts or pipes, scaling elevator shafts, or hiding under a moving cart. This works because the pathway into the building doesn't have all those nosy security guards asking for identification. Software may expose certain critical functionality with the assumption that nobody would think of trying to do anything but break in through the front door. But attackers know how to case a joint and figure out alternate ways of getting into a system.
No alerts in this category.

(6) Improper Access Control (Authorization)
Suppose you're hosting a house party for a few close friends and their guests. You invite everyone into your living room, but while you're catching up with one of your friends, one of the guests raids your fridge, peeks into your medicine cabinet and ponders what you've hidden in the nightstand next to your bed. Software faces similar authorization problems that could lead to more dire consequences. If you don't ensure that your software's users are only doing what they're allowed to, then attackers will try to exploit your improper authorization and exercise unauthorized functionality that you only intended for restricted users.
No alerts in this category.

(7) Use of Hard-coded Credentials
Hard-coding a secret password or cryptograpic key into your program is bad manners, even though it makes it extremely convenient - for skilled reverse engineers. While it might shrink your testing and support budgets, it can reduce the security of your customers to dust. If the password is the same across all your software, then every customer becomes vulnerable if (rather, when) your password becomes known. Because it's hard-coded, it's usually a huge pain for sysadmins to fix. And you know how much they love inconvenience at 2 AM when their network's being hacked - about as much as you'll love responding to hordes of angry customers and reams of bad press if your little secret should get out.
Most of the CWE Top 25 can be explained away as an honest mistake; for this issue, though, customers won't see it that way. Another way that hard-coded credentials arise is through unencrypted or obfuscated storage in a configuration file, registry key, or other location that is only intended to be accessible to an administrator. While this is much more polite than burying it in a binary program where it can't be modified, it becomes a Bad Idea to expose this file to outsiders through lax permissions or other means.
No alerts in this category.

(8) Missing Encryption of Sensitive Data
Whenever sensitive data is being stored or transmitted anywhere outside of your control, attackers may be looking for ways to get to it. Thieves could be anywhere - sniffing your packets, reading your databases, and sifting through your file systems. If your software sends sensitive information across a network, such as private data or authentication credentials, that information crosses many different nodes in transit to its final destination. Attackers can sniff this data right off the wire, and it doesn't require a lot of effort. All they need to do is control one node along the path to the final destination, control any node within the same networks of those transit nodes, or plug into an available interface. If your software stores sensitive information on a local file or database, there may be other ways for attackers to get at the file. They may benefit from lax permissions, exploitation of another vulnerability, or physical theft of the disk. You know those massive credit card thefts you keep hearing about? Many of them are due to unencrypted storage.
Total number of alerts in this category: 1
Alerts in this category
User credentials are sent in clear text
User credentials are transmitted over an unencrypted channel. This information should always be transferred via an encrypted channel (HTTPS) to avoid being intercepted by malicious users.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-310

Affected item
Affected parameter

/signup.php

Acunetix Website Audit

11

Variants

1

(9) Unrestricted Upload of File with Dangerous Type
You may think you're allowing uploads of innocent images (rather, images that won't damage your system - the Interweb's not so innocent in some places). But the name of the uploaded file could contain a dangerous extension such as .php instead of .gif, or other information (such as content type) may cause your server to treat the image like a big honkin' program. So, instead of seeing the latest paparazzi shot of your favorite Hollywood celebrity in a compromising position, you'll be the one whose server gets compromised.
No alerts in this category.

(10) Reliance on Untrusted Inputs in a Security Decision
In countries where there is a minimum age for purchasing alcohol, the bartender is typically expected to verify the purchaser's age by checking a driver's license or other legally acceptable proof of age. But if somebody looks old enough to drink, then the bartender may skip checking the license altogether. This is a good thing for underage customers who happen to look older. Driver's licenses may require close scrutiny to identify fake licenses, or to determine if a person is using someone else's license. Software developers often rely on untrusted inputs in the same way, and when these inputs are used to decide whether to grant access to restricted resources, trouble is just around the corner.
No alerts in this category.

(11) Execution with Unnecessary Privileges
Your software may need special privileges to perform certain operations, but wielding those privileges longer than necessary can be extremely risky. When running with extra privileges, your application has access to resources that the application's user can't directly reach. For example, you might intentionally launch a separate program, and that program allows its user to specify a file to open; this feature is frequently present in help utilities or editors. The user can access unauthorized files through the launched program, thanks to those extra privileges. Command execution can happen in a similar fashion. Even if you don't launch other programs, additional vulnerabilities in your software could have more serious consequences than if it were running at a lower privilege level.
No alerts in this category.

(12) Cross-Site Request Forgery (CSRF)
You know better than to accept a package from a stranger at the airport. It could contain dangerous contents. Plus, if anything goes wrong, then it's going to look as if you did it, because you're the one with the package when you board the plane. Cross-site request forgery is like that strange package, except the attacker tricks a user into activating a request that goes to your site. Thanks to scripting and the way the web works in general, the user might not even be aware that the request is being sent. But once the request gets to your server, it looks as if it came from the user, not the attacker.
This might not seem like a big deal, but the attacker has essentially masqueraded as a legitimate user and gained all the potential access that the user has. This is especially handy when the user has administrator privileges, resulting in a complete compromise of your application's functionality. When combined with XSS, the result can be extensive and devastating. If you've heard about XSS worms that stampede through very large web sites in a matter of minutes, there's usually CSRF feeding them.
Total number of alerts in this category: 19
Alerts in this category
HTML form without CSRF protection
This alert may be a false positive, manual confirmation is required.
Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts. Acunetix WVS found a HTML form with no apparent CSRF protection implemented. Consult details for more information about the affected HTML form.
CVSS

Base Score: 2.6
- Access Vector: Network
- Access Complexity: High
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None

Acunetix Website Audit

12

CWE

CWE-352

Affected item
Affected parameter
Variants

/comment.php

Affected item
Affected parameter
Variants

/hpp (914f51fea3c42cbd541a6953a8b115a4)

Affected item
Affected parameter
Variants

/signup.php

Affected item
Affected parameter
Variants

/userinfo.php (5f468405edac3bc49ce9b681482f2165)

2

2

2

4

Possible CSRF (Cross-site request forgery)
Manual confirmation is required for this alert.
This script is possibly vulnerable to cross-site request forgery. Cross Site Reference Forgery (CSRF/XSRF) is a class of attack that affects web based applications with a predictable structure for invocation. An attacker tricks the user into performing an action of the attackers choosing by directing the victim's actions on the target application with a link or other content. The attack works by including a link or script in a page that accesses a site to which the user is known (or is supposed) to have authenticated. Here is an example:

If the bank keeps authentication information in a cookie, and if the cookie hasn't expired, then victim's browser's attempt to load the image will submit the withdrawal form with his cookie.
This vulnerability is also known by several other names including Session Riding and One-Click Attack.
Affected item
Affected parameter
Variants

/AJAX/infotitle.php (257edd77c809c14112ab0ea46586da08)

Affected item
Affected parameter
Variants

/AJAX/infotitle.php (6b2b9ea0aa99c06cc65fb439a6f1003a)

Affected item
Affected parameter
Variants

/AJAX/infotitle.php (8fd68b800c8a41973e1feb997038495b)

Affected item
Affected parameter
Variants

/cart.php (c5fd95c5375478023e659a0853a6590d)

Affected item
Affected parameter
Variants

/comment.php (4feabc84d335bbd8dc53756d1fec8e2e)

Affected item
Affected parameter
Variants

/search.php (0e651d9ef24699ea550c39cad34f60aa)

Affected item
Affected parameter
Variants

/search.php (24e808ff5b078ac77913c5319fd4485c)

Affected item
Affected parameter
Variants

/secured/newuser.php (a225142f8969a6cfff2d8c188a956df2)

1

1

1

1

1

1

1

1

Acunetix Website Audit

13

Affected item
Affected parameter
Variants

/sendcommand.php (48d1dff56c320619a5a7237c993ba762)
1

(13) Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
While data is often exchanged using files, sometimes you don't intend to expose every file on your system while doing so. When you use an outsider's input while constructing a filename, the resulting path could point outside of the intended directory. An attacker could combine multiple ".." or similar sequences to cause the operating system to navigate out of the restricted directory, and into the rest of the system.
Total number of alerts in this category: 4
Alerts in this category
Directory traversal (verified)
This script is possibly vulnerable to directory traversal attacks.
Directory Traversal is a vulnerability which allows attackers to access restricted directories and execute commands outside of the web server's root directory.
CVSS

Base Score: 6.8

CWE

- Access Vector: Network
- Access Complexity: Medium
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: Partial
- Availability Impact: Partial
CWE-22

Affected item
Affected parameter
Variants

/showimage.php file 4

(14) Download of Code Without Integrity Check
You don't need to be a guru to realize that if you download code and execute it, you're trusting that the source of that code isn't malicious. Maybe you only access a download site that you trust, but attackers can perform all sorts of tricks to modify that code before it reaches you. They can hack the download site, impersonate it with DNS spoofing or cache poisoning, convince the system to redirect to a different site, or even modify the code in transit as it crosses the network.
This scenario even applies to cases in which your own product downloads and installs its own updates. When this happens, your software will wind up running code that it doesn't expect, which is bad for you but great for attackers.
No alerts in this category.

(15) Incorrect Authorization
While the lack of authorization is more dangerous (see elsewhere in the Top 25), incorrect authorization can be just as problematic. Developers may attempt to control access to certain resources, but implement it in a way that can be bypassed. For example, once a person has logged in to a web application, the developer may store the permissions in a cookie. By modifying the cookie, the attacker can access other resources. Alternately, the developer might perform authorization by delivering code that gets executed in the web client, but an attacker could use a customized client that removes the check entirely.
No alerts in this category.

Acunetix Website Audit

14

(16) Inclusion of Functionality from Untrusted Control Sphere
The idea seems simple enough (not to mention cool enough): you can make a lot of smaller parts of a document (or program), then combine them all together into one big document (or program) by "including" or "requiring" those smaller pieces. This is a common enough way to build programs. Combine this with the common tendency to allow attackers to influence the location of some of these pieces - perhaps even from the attacker's own server - then suddenly you're importing somebody else's code. In these Web 2.0 days, maybe it's just "the way the Web works," but not if security is a consideration. Total number of alerts in this category: 40
Alerts in this category
Cross site scripting
This script is possibly vulnerable to Cross Site Scripting (XSS) attacks.
Cross site scripting (also referred to as XSS) is a vulnerability that allows an attacker to send malicious code (usually in the form of Javascript) to another user. Because a browser cannot know if the script should be trusted or not, it will execute the script in the user context allowing the attacker to access any cookies or session tokens retained by the browser. CVSS

Base Score: 4.4

CWE

- Access Vector: Network
- Access Complexity: Medium
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
CWE-79

Affected item
Affected parameter
Variants

/showimage.php file 2

Cross site scripting (verified)
This script is possibly vulnerable to Cross Site Scripting (XSS) attacks.
Cross site scripting (also referred to as XSS) is a vulnerability that allows an attacker to send malicious code (usually in the form of Javascript) to another user. Because a browser cannot know if the script should be trusted or not, it will execute the script in the user context allowing the attacker to access any cookies or session tokens retained by the browser. CVSS

Base Score: 4.4

CWE

- Access Vector: Network
- Access Complexity: Medium
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
CWE-79

Affected item
Affected parameter
Variants

/404.php

Affected item
Affected parameter
Variants

/AJAX/showxml.php mycookie 1

Affected item
Affected parameter
Variants

/comment.php name 1

1

Acunetix Website Audit

15

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/guestbook.php name 2
/guestbook.php
text
2

Affected item
Affected parameter
Variants

/hpp/ pp 3

Affected item
Affected parameter
Variants

/hpp/index.php pp 3

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/hpp/params.php p 2
/hpp/params.php
pp
2

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/listdiagnosis.php patient 1
/listdiagnosis.php
cat
2

Affected item
Affected parameter
Variants

/search.php searchFor 2

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/secured/newuser.php uaddress 1
/secured/newuser.php
ucc
1
/secured/newuser.php uemail 1
/secured/newuser.php
uphone
1
/secured/newuser.php urname 1
/secured/newuser.php
uuname
1

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/userinfo.php uaddress 2
/userinfo.php
ucc
2

Acunetix Website Audit

16

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/userinfo.php uemail 2
/userinfo.php
uphone
2
/userinfo.php urname 2

(17) Incorrect Permission Assignment for Critical Resource
It's rude to take something without asking permission first, but impolite users (i.e., attackers) are willing to spend a little time to see what they can get away with. If you have critical programs, data stores, or configuration files with permissions that make your resources readable or writable by the world - well, that's just what they'll become. While this issue might not be considered during implementation or design, sometimes that's where the solution needs to be applied. Leaving it up to a harried sysadmin to notice and make the appropriate changes is far from optimal, and sometimes impossible.
Total number of alerts in this category: 92
Alerts in this category
Script source code disclosure
It is possible to read the source code of this script by using script filename as a parameter. It seems that this script includes a file which name is determined using user-supplied data. This data is not properly validated before being passed to the include function.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-538

Affected item
Affected parameter
Variants

/showimage.php file 1

.htaccess file readable
This directory contains an .htaccess file that is readable. This may indicate a server misconfiguration. htaccess files are designed to be parsed by web server and should not be directly accessible. These files could contain sensitive information that could help an attacker to conduct further attacks. It's recommended to restrict access to this file.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-16

Affected item
Affected parameter
Variants

/Mod_Rewrite_physician
1

Acunetix Website Audit

17

Application error message
This page contains an error/warning message that may disclose sensitive information. The message can also contain the location of the file that produced the unhandled exception.
This may be a false positive if the error message is found in documentation pages.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-200

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/listdiagnosis.php patient 1
/listdiagnosis.php
cat
2

Affected item
Affected parameter
Variants

/secured/newuser.php uuname 1

Affected item
Affected parameter
Variants

/showimage.php file 1

Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants
Affected item
Affected parameter
Variants

/userinfo.php uaddress 2
/userinfo.php
ucc
2
/userinfo.php uemail 2
/userinfo.php
uphone
2
/userinfo.php urname 2

Backup files
A possible backup file was found on your web-server. These files are usually created by developers to backup their work.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-538

Affected item

/index.bak

Acunetix Website Audit

18

Affected parameter
Variants
Affected item
Affected parameter
Variants

2
/index.zip
2

Directory listing
The web server is configured to display the list of files contained in this directory. This is not recommended because the directory may contain files that are not normally exposed through links on the web site.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-538

Affected item
Affected parameter
Variants

/.idea

Affected item
Affected parameter
Variants

/.idea/scopes

Affected item
Affected parameter
Variants

/_mmServerScripts

Affected item
Affected parameter
Variants

/admin

Affected item
Affected parameter
Variants

/Connections

Affected item
Affected parameter
Variants

/CVS

Affected item
Affected parameter
Variants

/Flash

Affected item
Affected parameter
Variants

/images

Affected item
Affected parameter
Variants

/Mod_Rewrite_physician/images

Affected item
Affected parameter
Variants

/pictures

Affected item
Affected parameter

/Templates

1

1

1

1

1

1

1

1

1

1

Acunetix Website Audit

19

Variants

1

Affected item
Affected parameter
Variants

/wvstests

Affected item
Affected parameter
Variants

/wvstests/pmwiki_2_1_19

Affected item
Affected parameter
Variants

/wvstests/pmwiki_2_1_19/scripts

1

1

1

Error message on page
This page contains an error/warning message that may disclose sensitive information. The message can also contain the location of the file that produced the unhandled exception.
This may be a false positive if the error message is found in documentation pages.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-200

Affected item
Affected parameter
Variants

/AJAX/infopatient.php

Affected item
Affected parameter
Variants

/AJAX/infocateg.php

Affected item
Affected parameter
Variants

/AJAX/infotitle.php

Affected item
Affected parameter
Variants

/Connections/DB_Connection.php

Affected item
Affected parameter
Variants

/pictures/path-disclosure-unix.html

Affected item
Affected parameter
Variants

/secured/database_connect.php

1

1

1

1

1

1

JetBrains .idea project directory
The .idea directory contains a set of configuration files (.xml) for your project. These configuration files contain information core to the project itself, such as names and locations of its component modules, compiler settings, etc. If you've defined a data source the file dataSources.ids contains information for connecting to the database and credentials. The workspace.xml file stores personal settings such as placement and positions of your windows, your VCS and History settings, and other data pertaining to the development environment. It also contains a list of changed files and other sensitive information. These files should not be present on a production system.

Acunetix Website Audit

20

CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-538

Affected item
Affected parameter

/

Variants

2

PHP errors enabled
The display_errors directive determines whether error messages should be sent to the browser. These messages frequently contain sensitive information about your web application environment, and should never be presented to untrusted sources. display_errors is on by default.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-16

Affected item
Affected parameter
Variants

/secured/phpinfo.php
1

PHPinfo page found
This script is using phpinfo() function. This function outputs a large amount of information about the current state of PHP.
This includes information about PHP compilation options and extensions, the PHP version, server information and environment (if compiled as a module), the PHP environment, OS version information, paths, master and local values of configuration options, HTTP headers, and the PHP License.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-200

Affected item
Affected parameter
Variants

/secured/phpinfo.php
4

Source code disclosure
Looks like the source code for this script is available. This check is using pattern matching to determine if server side tags are found in the file. In some cases this alert may generate false positives.

Acunetix Website Audit

21

CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-538

Affected item
Affected parameter
Variants

/index.bak

Affected item
Affected parameter
Variants

/pictures/wp-config.bak

1

1

WS_FTP log file found
WS_FTP is a popular FTP client. This application creates a log file named WS_FTP.LOG. This file contains sensitive data such as file source/destination and file name, date/time of upload etc.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-538

Affected item
Affected parameter
Variants

/pictures//WS_FTP.LOG
2

Documentation file
A documentation file (e.g. readme.txt, changelog.txt, ...) was found in this directory. The information contained in these files could help an attacker identify the web application you are using and sometimes the version of the application. It's recommended to remove these files from production systems.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-538

Affected item
Affected parameter
Variants

/.idea/Read Me.txt

Affected item
Affected parameter
Variants

/.idea/scopes/Read Me.txt

Affected item
Affected parameter
Variants

/_mmServerScripts/Read Me.txt

Affected item

/CVS/Read Me.txt

1

1

1

Acunetix Website Audit

22

Affected parameter
Variants

1

Affected item
Affected parameter
Variants

/Flash/Read Me.txt

Affected item
Affected parameter
Variants

/images/Read Me.txt

Affected item
Affected parameter
Variants

/Mod_Rewrite_physician/images/Read Me.txt

Affected item
Affected parameter
Variants

/wvstests/pmwiki_2_1_19/Read Me.txt

Affected item
Affected parameter
Variants

/wvstests/pmwiki_2_1_19/scripts/Read Me.txt

Affected item
Affected parameter
Variants

/wvstests/Read Me.txt

1

1

1

1

1

1

Possible virtual host found
Virtual hosting is a method for hosting multiple domain names (with separate handling of each name) on a single server (or pool of servers). This allows one server to share its resources, such as memory and processor cycles, without requiring all services provided to use the same host name.
This web server is responding differently when the Host header is manipulated and various common virtual hosts are tested. This could indicate there is a Virtual Host present.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-200

Affected item
Affected parameter
Variants

localhost
1

Email address found
One or more email addresses have been found on this page. The majority of spam comes from email addresses harvested off the internet. The spam-bots (also known as email harvesters and email extractors) are programs that scour the internet looking for email addresses on any website they come across. Spambot programs look for strings like myname@mydomain.com and then record any addresses found.
CVSS

Base Score: 5.0
- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None

Acunetix Website Audit

23

CWE

CWE-200

Affected item
Affected parameter
Variants

/

Affected item
Affected parameter
Variants

/404.php

Affected item
Affected parameter
Variants

/patients.php

Affected item
Affected parameter
Variants

/cart.php

Affected item
Affected parameter
Variants

/categories.php

Affected item
Affected parameter
Variants

/disclaimer.php

Affected item
Affected parameter
Variants

/guestbook.php

Affected item
Affected parameter
Variants

/index.bak

Affected item
Affected parameter
Variants

/index.php

Affected item
Affected parameter
Variants

/listdiagnosis.php

Affected item
Affected parameter
Variants

/login.php

Affected item
Affected parameter
Variants

/product.php

Affected item
Affected parameter
Variants

/search.php

Affected item
Affected parameter
Variants

/secured/phpinfo.php

Affected item
Affected parameter
Variants

/signup.php

Affected item

/Templates/main_dynamic_template.dwt.php

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Acunetix Website Audit

24

Affected parameter
Variants
Affected item
Affected parameter
Variants

1
/userinfo.php
1

Microsoft Office possible sensitive information
This document has been converted to HTML using Microsoft Office. It seems that Office has included sensitive information during the conversion.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-200

Affected item
Affected parameter

/secured/office.htm

Variants

1

Password type input with auto-complete enabled
When a new name and password is entered in a form and the form is submitted, the browser asks if the password should be saved.Thereafter when the form is displayed, the name and password are filled in automatically or are completed as the name is entered. An attacker with local access could obtain the cleartext password from the browser cache.
CVSS

Base Score: 0.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: None
CWE-200

Affected item
Affected parameter
Variants

/login.php

Affected item
Affected parameter
Variants

/signup.php

1

2

Possible internal IP address disclosure
A string matching an internal IPv4 address was found on this page. This may disclose information about the IP addressing scheme of the internal network. This information can be used to conduct further attacks.
This alert may be a false positive, manual confirmation is required.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-200

Acunetix Website Audit

25

Affected item
Affected parameter
Variants

/404.php

Affected item
Affected parameter
Variants

/pictures/ipaddresses.txt

Affected item
Affected parameter
Variants

/secured/phpinfo.php

1

1

1

Possible server path disclosure (Unix)
One or more fully qualified path names were found on this page. From this information the attacker may learn the file system structure from the web server. This information can be used to conduct further attacks.
This alert may be a false positive, manual confirmation is required.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-200

Affected item
Affected parameter
Variants

/pictures/path-disclosure-unix.html

Affected item
Affected parameter
Variants

/secured/phpinfo.php

1

1

Possible username or password disclosure
A username and/or password was found in this file. This information could be sensitive.
This alert may be a false positive, manual confirmation is required.
CVSS

Base Score: 5.0

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
CWE-200

Affected item
Affected parameter
Variants

/Connections/DB_Connection.php

Affected item
Affected parameter
Variants

/pictures/credentials.txt

Affected item
Affected parameter
Variants

/secured/database_connect.php

1

1

1

Acunetix Website Audit

26

(18) Use of Potentially Dangerous Function
Safety is critical when handling power tools. The programmer's toolbox is chock full of power tools, including library or API functions that make assumptions about how they will be used, with no guarantees of safety if they are abused. If potentially-dangerous functions are not used properly, then things can get real messy real quick.
No alerts in this category.

(19) Use of a Broken or Risky Cryptographic Algorithm
If you are handling sensitive data or you need to protect a communication channel, you may be using cryptography to prevent attackers from reading it. You may be tempted to develop your own encryption scheme in the hopes of making it difficult for attackers to crack. This kind of grow-your-own cryptography is a welcome sight to attackers. Cryptography is just plain hard.
If brilliant mathematicians and computer scientists worldwide can't get it right (and they're always breaking their own stuff), then neither can you. You might think you created a brand-new algorithm that nobody will figure out, but it's more likely that you're reinventing a wheel that falls off just before the parade is about to start.
No alerts in this category.

(20) Incorrect Calculation of Buffer Size
In languages such as C, where memory management is the programmer's responsibility, there are many opportunities for error. If the programmer does not properly calculate the size of a buffer, then the buffer may be too small to contain the data that the programmer plans to write - even if the input was properly validated. Any number of problems could produce the incorrect calculation, but when all is said and done, you're going to run head-first into the dreaded buffer overflow.
No alerts in this category.

(21) Improper Restriction of Excessive Authentication Attempts
An often-used phrase is "If at first you don't succeed, try, try again." Attackers may try to break into your account by writing programs that repeatedly guess different passwords. Without some kind of protection against brute force techniques, the attack will eventually succeed. You don't have to be advanced to be persistent.
No alerts in this category.

(22) URL Redirection to Untrusted Site ('Open Redirect')
While much of the power of the World Wide Web is in sharing and following links between web sites, typically there is an assumption that a user should be able to click on a link or perform some other action before being sent to a different web site.
Many web applications have implemented redirect features that allow attackers to specify an arbitrary URL to link to, and the web client does this automatically. This may be another of those features that are "just the way the web works," but if left unchecked, it could be useful to attackers in a couple important ways. First, the victim could be autoamtically redirected to a malicious site that tries to attack the victim through the web browser. Alternately, a phishing attack could be conducted, which tricks victims into visiting malicious sites that are posing as legitimate sites. Either way, an uncontrolled redirect will send your users someplace that they don't want to go.
Total number of alerts in this category: 1
Alerts in this category
URL redirection
This script is possibly vulnerable to URL redirection attacks.
URL redirection is sometimes used as a part of phishing attacks that confuse visitors about which web site they are visiting. CVSS

Base Score: 6.4

CWE

- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: Partial
- Availability Impact: None
CWE-601

Affected item
Affected parameter
Variants

/redir.php r 1

Acunetix Website Audit

27

(23) Uncontrolled Format String
The mantra is that successful relationships depend on communicating clearly, and this applies to software, too. Format strings are often used to send or receive well-formed data. By controlling a format string, the attacker can control the input or output in unexpected ways - sometimes, even, to execute code.
No alerts in this category.

(24) Integer Overflow or Wraparound
In the real world, 255+1=256. But to a computer program, sometimes 255+1=0, or 0-1=65535, or maybe
40,000+40,000=14464. You don't have to be a math whiz to smell something fishy. Actually, this kind of behavior has been going on for decades, and there's a perfectly rational and incredibly boring explanation. Ultimately, it's buried deep in the
DNA of computers, who can't count to infinity even if it sometimes feels like they take that long to complete an important task. When programmers forget that computers don't do math like people, bad things ensue - anywhere from crashes, faulty price calculations, infinite loops, and execution of code.
No alerts in this category.

(25) Use of a One-Way Hash without a Salt
Salt might not be good for your diet, but it can be good for your password security. Instead of storing passwords in plain text, a common practice is to apply a one-way hash, which effectively randomizes the output and can make it more difficult if (or when?) attackers gain access to your password database. If you don't add a little salt to your hash, then the health of your application is in danger.
No alerts in this category.

Acunetix Website Audit

28

Similar Documents

Premium Essay

Information Technology

...Information & Communications Technology Research Proposal Name: Institution Affiliation: Background There has been developing awareness that the power information technology and computing. This must be, and can be, amplified past its customary client base to achieve individuals who up to this point have not had an entry to such innovation. Being digitally joined has gotten to be continually basic to economic, instructive, and social headway. The objective of this exploration subsidizing activity is to create new information that will help stretch the capacities of figuring engineering better to serve social and economic difficulties of underserved groups, both provincial and urban. The expression Data and Communication Technology for Development are likewise utilized as a part of the scholarly research group to depict this same objective. Information and Communication Technologies must be moderate, available, and important. Novel methodologies in figuring engineering have the potential for the extraordinary effect in a scope of regions, including instruction, human services, and economic improvement. The significance that exploration projects can have around there is noteworthy since there are troublesome mechanical issues to be unraveled to understand that vision. For example, work in last-mile organizing bases, making instinctive client interfaces, creating ease processing gadgets and making applicable applications in regions (Werthner, 2009). Research Purpose ...

Words: 988 - Pages: 4

Premium Essay

Information Technology

...Information Technology (IT) Information Technology (IT) Information technology, in the first instance, brings to us the latest developments in science, technology and the arts in the advanced world. We can make use of the latest techniques and methods in the sciences and the arts within the four corners of our buildings. We can communicate with anyone anywhere in the world and send him messages in a jiffy. The e-mail has made it possible to send any amount of information to any place in a few seconds. The receiver of the information can at once send back the reply or his own information. Talk on programmes like hotmail messenger or yahoo messenger, along with the display of the talkers on the screen, gives a direct personal touch to the exchange of information and ideas. Information technology has, in effect, reduced distance completely between parties sitting in continents separated by the high seas and immeasurable skies. Computer technology can help us to bring about social, political and economic revolution in the country. We can make a complete study of the different social, political and economic systems in the most successful countries. The past, present and possible future of these countries and societies can be studied through computer records, films and programmes.4essay.blogspot.com Computer technology can be used to collect information about the different classes and groups of the people in the country. A thorough study of their educational, professional and social...

Words: 461 - Pages: 2

Premium Essay

Information Technology

...Chapter 1 1. How can information technology support a company’s business processes and decision making and give it a competitive advantage? Give examples to illustrate your answer. The term information technology refers to the various hardware, software, networking, and data management parts that are a necessity for the system to function (pg. 8). Businesses regularly utilize computer-based information systems in order to record customer purchases, keep track of inventory, pay employees, buy new merchandise, and evaluate sales trends. Without the support of information technology, businesses would ultimately fall apart. For example if a business did not choose to use computer-based information systems, they wouldn't be able to evaluate what items were selling better than others and ultimately lose valuable information for future success. Information technology can also aid in decision making for a business. Decisions are made based on analysis provided by computer-based information systems. For example a store manager may make the decision whether to discontinue an item for sale or keep it on the floor due to analysis of sales trends provided by computer-based systems. Lastly information technology helps business gain a competitive advantage. A competitive advantage is gained through computer-based information systems by applying innovative application of information technologies (pg. 9). For example a store manager installing touch screen kiosks throughout the organization...

Words: 1404 - Pages: 6

Premium Essay

Information Technology

...Information technology affects almost every aspect of the business world in today’s modern society. Within a matter of decades both internal and external processes have been transformed. For example, managers no longer handwrite reports for their office staff to type or use mail to correspond with clients or post flyers to communicate with employees. My department at Princeton University has experienced these types’of scenarios over the past five years. Five years ago, our procedures and computers systems were antiquated. The need for technology was essential to provide better communication and improve procedures, especially in a department that has over 200 employees who work in different locations throughout the University such as dorms, academic buildings, and athletic facilities. For instance, my department’s time-off request procedure and the process by which supervisors receive their daily work orders were lengthy, required several steps, and needed to be modernized. Realizing how outdated these procedures were, my department sought out several different types of technology to help improve its overall functionality. Technology acquired included, Sharepoint, Ipads, and EZ Maxmobile App. In just a short period of time, these products have significantly improved communication and procedures throughout the department and enhanced our customer service to our clients. The use of Sharepoint, a web-based intranet that streamlines the management of and access to data,...

Words: 416 - Pages: 2

Premium Essay

Role of Information Technology

...International Journal of Information Science and Technology THE ROLE AND EFFECT OF INFORMATION TECHNOLOGY IN THE CREATION AND MAINTENANCE OF SUSTAINABLE COMPETITIVE ADVANTAGE A. Talebnejad[1] Faculty of Management and Accounting Shahid Beheshti University Email: taleb149@yahoo.com Abstract -By the appropriate use of information technology, organizations can achieve sustainable competitive advantages. This technology because of including some characteristics such as being up-to-date, fast and precise and having different geographic localities all the time, has improved organizational efficiency, effectiveness and performance. In this article, we intend to investigate the role and effect of information technology in the creation and maintenance of sustainable competitive advantages from two different approaches: market-based approach and the resource-based approach. In the Market-based approach, meeting customer's and creating values for them, using information technology and the issue of achieving the competitive advantage and position in the market by organizations are addressed. In the resource-based approach, compatibility of the organization's resources such as those of information technology and organizational skills, particularly managerial ones are investigated. Amongst different organizational skills and resources, only managerial skills of information technology can create a sustainable competitive advantage. Keywords: Information Technology, Sustainable Competitive...

Words: 4885 - Pages: 20

Free Essay

Policing Information Technology

...Policing Information Technology Bill Smith BIS/220 July 11, 2012 Alisha Johnson Abstract Policing Information Technology Over the past 30 years technology has advanced at an alarming rate. Since the inception of personal computers and the World Wide Web a need for individual protection occurred. Government reform was needed. In the 1980s two Acts of Congress were passed, the Computer Fraud and Abuse Act of 1986 and the Electronic Communications Privacy Act of 1986. Initially we will examine the advances in technology that caused each Act to be passed. Last we will determine what new ethical issues came about from this new technology. Although some may see these Acts as an invasion of one’s right to privacy, they are essential to protect stored information from being used in a negative way. “A survey by an ABA task force in 1984 estimated that businesses and government agencies lose as much as $730 million a year to computer crime” (Wolf, 1986). Two years after this survey was published the U.S. House of Representatives passed the Computer Fraud and Abuse Act of 1986. During this time computers are becoming widely used across the country. The major change is the type of information being stored. Financial institutions both in the private and government sectors are using computers to store valuable financial information. Computer hackers illegally could gain access to this information and sell it to individuals with the means to use it or vandalize the company’s...

Words: 529 - Pages: 3

Premium Essay

Information Technology Tool

...partner in a new business, one of your roles is to review information technology tools available to assist you in a certain aspect of your business (e.g., marketing, accounting, sales, quality assurance). Select a technology that emerged within the last five years and consider its impact on your business. Make a decision on whether to adopt this technology. B. Information Technology Tools 1. How technology helps business grow * SBA. (December 13, 2010).New Technology Guide Helps Entrepreneurs Grow Their Small Businesses and Create Jobs. Retrieved April 10, 2012 from, http://archive.sba.gov/idc/groups/public/documents/sba_homepage/news_release_10-71.pdf * Smart Business Information Technology. (2012). Information technology aids in business growth. Retrieved April 10, 2012 from, http://bizitc.com/performance/information-technology-aids-in-business-growth/ * SBA. (2012). New technology guide helps entrepreneurs grow their small businesses and create jobs. Retrieved April 10, 2012 from, http://www.asbdc.org/Library/SBA%20Technology%20Guide.pdf * Entrepreneurs’ Organization. (2012). How I leveraged technology to grow my business. Retreived April 10, 2012 from, http://www.eonetwork.org/knowledgebase/specialfeatures/Pages/HowILeveragedTechnologytoGrowMyBusiness.aspx 2. How technology lessens the geographical gap between countries * Net Industries. (2012). The international gap in technology. Retrieved April 10, 2012 from, http://education.stateuniversity...

Words: 2563 - Pages: 11

Free Essay

Information Technology Acts

...Information Technology Acts Chad T Lane BUS/220 30 June 2014 Mrs Colette Gardner Information technology is a dynamic and rapidly changing industry. Up until roughly two hundred years ago, all communication required walking, horseback, or some other form of manual labor. The telegraph was the first step down the path of information technology when Claude Chappe first invented it in 1794 (Bellis, ). The telegraph was the gateway to a plethora of other forms of communication that lead to social media, email, blogging, text messaging, etc. The internet is probably the biggest and most powerful breakthrough in information technology. With that, comes a lot of potential for people to do things they should not, say things they would not say in person, and target an audience that might have gone otherwise unreached. The Children’s Internet Protection Act of 2000 was passed in order to prevent children from exposure to pornographic material and things that are not age appropriate for young children in situations where schools or libraries receive internet at a discounted rate  (FCC,). Prior to the internet, someone wishing to purchase pornography or R-rated movies would be required to prove legal age to do so because these transactions largely took place in person. The internet has no hard and fast way of verifying age so keeping children away from things they should not see, requires use of filters and other resources to block certain material and websites. Many people will...

Words: 467 - Pages: 2

Premium Essay

Information Technology in Business

...Riordan Manufacturing business chose to outsource their information technology (IT) systems and services for a variety of reasons. This choice carries with it some obvious benefits and some often not so obvious risks. Companies choosing to outsource IT must weigh the benefits and risks carefully, take measures to attenuate the associated risks and prepare their employees for the change by launching a campaign about the benefits of outsourcing. The risks involved with outsourcing mainly involve accessibility to service. According to Applegate (1995), if you rely on an outside contractor who generally has to come onsite to support your network, then [consider removing "then"] you live in a world where you simply hope critical services don’t [Contractions are inappropriate in academic writing--write it out] go down at a time when your ability to conduct business will be interrupted. Busy IT contractors may take days before they can come in to help, and this will likely be unacceptable if the problem is making it impossible for your staff to work. All the money saved by using a pay-as-you-go contractor can be lost with one serious issue within your network. With remote IT support such as managed services, some business owners are uncomfortable with having less personal touch and immediate feedback. When you have your own network administrator onsite, you can call them into your office and get a report or have questions answered. A remote based service will never be able to match...

Words: 991 - Pages: 4

Premium Essay

Communication and Information Technology

...Communication and Information Technology Latasha Wright HCS/320 June 18, 2012 Patricia Bird Communication and Information Technology Communication and information technology is frequently used as way to deliver effective communication messages. Many standard organizations such as hospitals and medical facilities continue to find ways to implement and improve communication channels. For these reasons, the use of e-mail communication in the hospital setting should be used as a way to enhance communication and information technology. First, I will explain how efficient and effective e-mail communication improves hospitals’ communication between personnel and patients. Because implementing new forms of technology comes with some advantages and disadvantages; I will discuss the incentives and drawbacks as well as its influences on consumers. Next I will explain the short and long-term financial impact that e-mail communication has on organizations. Then, I will provide technical improvements with e-mail communication in the future and why. Last, I will make necessary recommendations to improve e-mail communication in the hospital environment. My hope is that this essay will provide a better understanding about the use of e-mail communication and how organizations can benefit from its use. Efficient and Effective A popular form of communication, e-mail communication, is both efficient and effective for organizational use. E-mail communication is said to...

Words: 1070 - Pages: 5

Free Essay

Information Technology Acts

...Information Technology Acts Paper Ryan Beland BIS/220 Mr. Vozella 7/28/2104 In today’s world we do not start our mornings with an essential meal, a cup of coffee, and reading the newspaper; but with the simple press of one of the most iconic buttons, the power button. The dramatic increase in technology demands the attention of almost every person across the globe as they connect, work, and coordinate daily plans and objectives with those close and far away. Information technology is one of the largest demanded and growing systems users have available. Information technology is the use of computer and telecommunication based systems; to store, send, manipulate, and retrieve data information across the various environments for the users utilizing the systems (Wikipedia, 2014). From professional, academic and personal situations these systems are more than ever present in the daily routine. The increased demand and use of these systems does make daily tasks easier and quicker to complete, but even the most beneficial tools can come with a cost. The information systems we utilize improve efficiency and effectiveness, but open doors for dangerous, illegal, and unethical actions. In order to control or limit these technological woes, various laws and procedures have been put in place to protect the users and societies that wish to implement these systems features into their lives. In this paper we will examine two laws specifically what they entail, the ethical dilemmas...

Words: 1432 - Pages: 6

Premium Essay

Communication and Information Technology

...Communication and Information Technology HCS/320 January 28, 2012 Dr. B Communication and Information Technology Communication has been a key element in the health care field for many years. A patient communicates to the physician what is wrong with them, the physician communicates with the nurse what is to be done, and the information is entered into the patient file. The medical biller then bills the insurance or patient by sending an electronic claim, and the payer sends back a statement of payment. All this is considered communication. Over the years technology has advanced and the ways these communications have been used have changed. Now communication is done electronically, sent by email and even text message; there is even a way to teleconference over video phone with a patient or physician. After researching new technology I found Vocera, a communication system that makes communicating between team members faster and easier. The system uses a hand held device as well as a computer based program to communicate messages even alerts to get in touch with team members. The voice activated hand held device is the size of a cell phone and is typically hung around the neck. The hand held voice activated device can be used to call another team member, or can be used to access a paging system in case of emergency situations. Physicians can use the device to turn on their status, such as on call or on lunch break. When the computer based program is accessed by a nurse looking...

Words: 777 - Pages: 4

Free Essay

Information Technology Acts

...Information Technologies Acts Information Technologies Acts The two acts that have been chosen for this paper are the Do Not Call Act of 2003 and the Children’s Internet Protection Act of 2000. I chose these because these are two of the biggest issues plaguing society today. It is always an ongoing battle to find and implement ways to protect children from the ever expanding corruptness that this world is throwing at us daily. It is also a never ending battle to keep us safe from harassment. The Children’s Internet Protection Act was passed to help keep children’s use of the internet in libraries and school safe and free of information and images children should not be exposed to. As Information Technology continues to grow and comes up with new ways to get the information out and people are intelligent enough to link undesirable information such as pornographic materials, sexually explicit materials, Etc. We as a society needed to find ways to keep our children from getting corrupted by such vulgarity. Thus the Children’s Internet Protection Act was born. It helps to ensure that our children are not exposed to information and materials not appropriate for them. It requires libraries and schools to implement filters to block inappropriate material from being viewed by children. The Do Not Call Act of 2003 was implemented to provide a regulation from harassment by telemarketers if their phone number is on a do not call list. As technology has expanded, it has become increasingly...

Words: 556 - Pages: 3

Premium Essay

Information Technology Agenda

...IT Agenda 1 IT Agenda and Organizational Strategies HCI 510 November 19, 2012 Mr. Lee Edwards IT Agenda 2 To achieve success in this information economy, IT is a critical facet of any organization. IT goals exists to help organizational leaders understand why IT goals must align with those of the business, how IT delivers value, and how its performance is measured, its resources properly allocated and its risks mitigated. In this paper, I will be discussing the relationship between the IT Department and organizational strategies, along with strategies that make an effective IT Department. Effective organizational strategies should be looked at like a wheel. It comprises five components: Leadership, Decision-making and structure, People, Work processes and systems and of course, culture. Leadership comprises a clear vision and priorities and a cohesive leadership team. The decision making portion makes up clear roles and accountabilities for decisions and an organizational structure that supports objectives. The people portion of the wheel includes organizational and individual talents necessary for success, and performance measures and incentives aligned with objectives. Work processes and systems encompass superior execution of pragmatic work processes and effective and efficient support processes and systems. And, finally the last portion is the organization culture. The culture covers high performance values and behaviors and a...

Words: 867 - Pages: 4

Free Essay

Information Technology Acts

...Information Technology Acts BIS/220 BSAH16ZDG6 Facilitator: Dr. Charles A. von Urff Week 1 Individual Assessment Due March 11, 2013 Submitted March 11, 2013 Executive Summary In today’s age and society, information technology is a growing necessity in the functioning of retrieving information from the internet. Thus access to the internet is available to everyone no matter the age. In order to protect all ages of internet users, the United States Congress has passed several Acts to protect users. With the advances in information technology the ethical issues of privacy and appropriate content in regards to children have lead to the United States Congress passing the Children’s Internet Protection Act of 2000 (CIPA) and Children’s Online Privacy Protection Act of 1998 (COPPA). Each Act has its own ethical issues as to it’s creation with the importance of children’s safety as the main concern. Introduction With the advancement of information technology in which all ages of users are being accommodated, everyone in today’s society has access to utilize all forms of information technology. The usage of information technology can include but is not limited to listening to music, watching movies/videos, playing games, communicating via email, social networks, or chat rooms, and getting help with school assignments. The researching of information via information technology...

Words: 994 - Pages: 4