4 ms·
I might be missing something here, having never used MongoDB, but what does this have to do with it? How else can this attack vector be used?
by s00pcan 16y ago
I might be missing something here, having never used MongoDB, but what does this have to do with it? How else can this attack vector be used?
- methodin 16y ago$ne = not equals which translated to "give me everything not equal to foo". Using this you can basically get a dump of all the data or update with foobarred critera - updating all passwords for all users not equal to foo, for instance
- nbpoole 16y agoThere's a very good example here: http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-to-sql-injection-in-php-at-least/ http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-...