Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I found (ridiculously easy to discover) a SQL injection bug on a public facing website. I strongly suspect that in the same database are stored credit card numbers of their customers (although not mine).

I wrote to a service email address but got no response and the site is still on with the same error.

What should I do now? Is there any legal requirement for the company to respond/to do something (we are talking about the German branch of an American company)?

share|improve this question

2 Answers 2

Try and get in touch with the people who created the website as opposed to a normal support line which will be more tailored to the product/service they provide and won't know what to do with the issue you raise. Maybe contact them and specifically ask to be transferred to the people in charge of the website, they may very well crap themselves when they realise what can be done.

If that fails, try looking at the domains whois records for a technical email, maybe a humans.txt or just look at the source code for a meta tag.

One thing you should not do is use the exploit to gather any data - even as an example, you could get is just as much trouble with the law as if you hacked the site yourself.

share|improve this answer

Sadly, most organizations are non-proactive to issues like these. One of the sites I've worked on allows all sql attacks, the only protection is the user account does not allow anything but "select from "

THE FUN ANSWER ;) If you want real results, abuse the security hole. That will get there attention alot faster, like email them the result of one of your attacks. Or say Subject line: "Hey check out the cool new tables I created in your database"

share|improve this answer
1  
xkcd.com/327 :) –  Andrew Charlton May 11 '11 at 18:06
    
It's all fun and games until someone loses an eye (or you get a prison mate that thinks computer geeks are hot) –  JMC May 11 '11 at 20:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.