3 ms·
Once he found the SQL injection, downloading the tables was too far IMO. On the other hand if he had stopped at this point, the company would have no idea abou
by r1ch 5y ago
Once he found the SQL injection, downloading the tables was too far IMO.
On the other hand if he had stopped at this point, the company would have no idea about the weak admin credentials that could lead to real data breach and internal compromise at a later date.
- indigodaddy 5y agoIf he has no malicious intent and is not going to view/sell or do anything malicious with the data, I think it’s fine or even beneficial for him to continue to find further vulnerabilities and then report the whole package of vulnerabilities to the company. As long as he wraps it up within a few hours or say max 24 hrs and then immediately reports after that.