MongoDB

Injection in insert

drag_indicator
info
drag_indicator
inputs
drag_indicator
inspect

Modifying the collection

This time the injection point is in an insert statement, Try to inject an extra filed in you maillinglist entry

Goal: Insert an entry with {"HACK": "YesWeHack"}

Solution

Read the solution
expand_more

Solution

$mail = test@example.com", "HACK": "YesWeHack $mail_f = test@example.com

Explanation

Since mongo is document based, you can insert any field in any document.

drag_indicator
waf
INPUT
OUTPUT
drag_indicator
code
drag_indicator
result