Congrats!

Ignoring OP's config fuck-up, I think you did a service to the world, showing this vulnerability is very much real.