Last week while reading an article on a website the URL ending in .php?id=1
it just asked to be tested for SQLi. When I confirmed that it was vulnerable I also found out that there was no user input filtering and a simple "<script>alert(1)</script>
was possible.
When looking for a contact email to report the vulnerability I only found addresses for specific departments, like finance@badwebsite.com.
Since I did not want to just send the vulnerability report randomly I called the company, explaining that I found a problem in their website and that it would be a good idea to get it fixed. I explained that I would like to get in touch with someone from IT or someone who has any relation to the people that maintain the website.
The person on the phone got quite aggressive, told me to take a hike (used a bit less friendly language) and told me I had nothing to do with their IT department of website.
How can I convince people about the importance of a vulnerability and the disclosure when they are not familiar with IT? Especially when no email contact is possible?
FYI, I believe I was very polite and calm on the phone.