What you describe is nothing malicious. I'm not a lawyer, so I can't say whether it technically runs afoul of laws proscribing "unauthorized access/use of computer systems." Also, it may technically run afoul of the host's terms and conditions.
Again, IANAL, so I can't rule out the sad possibility that you could be in legal trouble for what you did ... assuming that a hosting service that left a vulnerability like that open had the means and interest to review your activity (I leave it to the reader to assess the probability of that). However, as a businessman I think the following facts are salient:
- You noticed a security hole.
- You did the bare minimum to verify it.
- You did absolutely no damage to the computer system, and you did not access any substantial unauthorized data.
If I were you I'd first check with the host to see if they offer bounties for finding security holes. If they don't, I'd notify them. If you alert them and don't ask for money, make threats, or anything else, you're going as white-hat as you can, and they should be relieved that you aren't attempting to exploit or extort your find. (Heck, they should be so grateful that they should offer you a substantial reward, but again, reality often fulls short of such ideals ;)