I found a extremely vulnerable child care site

[andrew101010]

The website is a non-profit children care site... but it's admin login is extremely vulnerable to simple sql injections. Once someone hacks the admin login, they can access a database of all there clients information. How should I tell the site owners about the danger. I don't want to get arrest, but I also don't want anyone to steal their clients information. Should I alert the site owner?

Sorry if I posted this in the wrong thread.

[hellow533]

What's the sites name? Can you tell us what site this is? Also, somewhere on there should be a contact/contact us button. Try calling them and telling them upfront.

[andrew101010]

I don't want to give out the site name. There is a contact page, but some of the employee's email address are .gov. The site offers child care services and offers advice. It's run by a bunch of kind old ladies.

[insomaniacal]

Use Tor to set up a fake g-mail account for yourself and drop them a line about it.

[Goatboy]

insom said it best, although that might be a little overkill. Basically, your best bet is to send an anonymous email and hope they fix it. You don't want to assume that they will be happy, because they might not be. This could land you in some trouble very quickly.