Better explanation: https://www.reddit.com/r/netsec/comments/9wzwgw/0day_bypassi...

The one the owner thinks was not used as he only saw database access not shell access but was mentioned by ZDNet as getting well known around the time this database was emptied.

(nb: page is in Russian)