MongoDB Operator Injection
Summary#
Invicti detected that the application is vulnerable to a MongoDB operator injection. MongoDB injections occur when applications don't sanitize user input, which is then interpreted by a MongoDB database.
Impact#
Depending on the backend database version, an attacker can perform one of the following types of attacks successfully:
- Reading, updating or deleting arbitrary data from the database
- Collect sensitive information about the backend server configuration
Remediation#
To avoid this vulnerability;
- Sanitize user-supplied input and strictly check its type
- Use most recent version of MongoDB.
Classifications#
Vulnerability Index
You can search and find all vulnerabilities
Select Category
OR
Search Vulnerability
Related Vulnerabilities
