Hacker News Reader

Looking around I found a simple CMS sold to small online stores. Through their links you can find a listing of their customers (people who use their CMS). Problem is the CMS is open to SQL injection everywhere. If a script kiddie found this info they could take down a lot of online stores. Not good.

View on HN

There are tools that will find these and do all kinds of keep-you-up-at-night terrifying things with your application.

You don't even have to be a script kiddie. You just have to be able to click a button.

Did you tell them?

Or better yet write a patch and submit a pull request informing them.

Reply on news.ycombinator.com