So the story goes like this..
I recently rediscovered an old website i used to go on quite often but i couldn't remember my login. The site is poorly made and hasn't been updated in about 5 years, so i tried a simple SQL-Injection to gain access to my old account and lo and behold, i was in. The problem is that i (and anyone else with a bit of SQL knowledge) have access to ~2000 users:
- Password (Plain/text)
- Full Name
- Date of Birth
- Private Messages
So i did the right thing, I sent an email to the owner of the site. It's been over a month and no response or changes to the site.
My question being:
What should i do in this position? Should i try to take down the site in a "not so legal" way? i doubt the owner will do anything about it. It's an old site with not more than 10-40 people online at one given time but a lot of people reuse emails and passwords so i bet that a lot of them could work on other more important accounts.