I have recently discovered a Buffer Overflow vulnerability that leads to Remote Code Execution. However, due to the structure of the application assessed, a lot of so-called 'bad chars' came up. The list is as follows:
It basically eliminated the whole uppercase alphabet A-Z, since the application turns these letters to lowercase.
The question is, is exploitation still possible in such a case? If so, what are the methods to achieve it?