Disclosure of the zero-day vulnerability I found, exploited, and disclosed regarding Easy File Sharing Web Server 7.2. GET HTTP request, PassWD parameter.
Set up the application in a WinXP SP3 VM in my lab, loaded the app. Found an exploitable crash via fuzzing with Spike that was previously undisclosed. Replicated the crash using python, then refined and exploited it gaining system level privileges on the machine.