This question already has an answer here:
Four years ago, I discovered that an applet on my college's website sends SQL queries directly to a server application. The databases contain nominal and personal information about students and grades, and possibly more (SSNs?), but I'm not sure as I haven't tried anything, because I'm a good person.
In December 2010, I warned them of the potential vulnerabilities, and they thanked me. I know for a fact that the CTO was warned.
Four years later, the application is still up. The mechanics haven't changed, and the (deobfuscated) packet capture still shows SQL requests going to the server from the client. It could be that the server somehow checks them against a list of valid requests or something, but I can't be sure, and there are probably a few tripwires that I don't want to risk triggering without formal authorization–which is not something that I expect to get.
What should I do?