This question already has an answer here:
i'm a student cybercrime.
I've tested sql injection on an indian site that sells properties etc..
I was vunerable so i kept going with testing.
so after half an hour i managed to get all the usersnames and passwords also the admin username and password + adminpage.
What should i do now? just leave it or report it to the organisation?
i'm a bit afraid that they will be angry that i did this you know.
I really want to report it but its just i don't want to get troubles or so
EDIT : i did nothing to the site or database, i just looked in the database