NoSQL Injection
High · Injection · CWE-943
Description
Operators injected into MongoDB-style queries.
Root cause
JSON body bound directly to query.
Impact
Auth bypass, data leak.
Detection
Operator injection ($ne, $gt) tests.
Mitigation
Schema validation; type-safe ODM usage.
Secure coding
Reject unexpected operators in filters.
Safe lab example
NoSQLi labs
Practise related skills in Labs or deepen on Academy library.