<![CDATA[The current development of information technology encourages non-profit organizations to utilize web-based information systems to support their public services. However, along with this utilization, the issue of information system security has become crucial due to the high frequency of cyber-attacks. This study aims to identify vulnerabilities, conduct penetration testing, and measure the level of security risk on the main portal (http://apisi.org) and library information system (http://opac.apisi.org) belonging to the Indonesian School Information Professionals Association (APISI). This experimental study applies the Zero Entry Hacking (ZEH) methodology which includes four main phases: Reconnaissance, Scanning, Exploitation, and Post-Exploitation. The results of comprehensive testing using various security audit tools detected a total of 41 vulnerabilities in the APISI information system. Based on the measurement results using the Common Vulnerability Scoring System (CVSS) v3.1 calculator, 2 vulnerabilities were found to be categorized as Critical and 9 vulnerabilities to be categorized as High. Overall, the APISI website has an average vulnerability level of 6.6 on a scale of 10, which is included in the medium risk category. The exploit successfully demonstrated the execution of a Cross-Site Scripting (XSS) attack on the OPAC and the upload of a backdoor using Weevely, which granted full control over the server directory. Recommendations included establishing a security Standard Operating Procedure (SOP) and closing the security gap by regularly updating the software version.]]>
Copyrights © 2026
