Wow, this is really bad.

With all the discussions revolving around the more advanced side of SSL for non PII something like this, which violates PCI and other requirements, simply goes unnoticed.

I wonder if the person deploying this warned the company and the higher ups just ignoring him/her...