can we please not refer to a kid who exploits a 10-year-old known vulnerability as a "researcher".
Just because the vulnerability is old doesn't mean you can disrespect his profession. Sometimes people just write bad code. I'm sure you've done the same.
I'm arguing that this isn't research. There was no novel technique used or investigation into original paths of exploitation or increasing our understanding of previously unknown areas of anything.
There's a material reason I said the above; calling the individual a researcher suggests that the exploitation of AFF was something quite complicated requiring a previously unknown attack, taking away from the fact that having an LFI in your app in 2016 is potentially bad luck but more likely just negligent; it should be highlighted as such.
And the next week, a later article corrected to "a script kiddie from HackForums" as determined by the FBI :D