refer uri: http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-to-sql-injection-in-php-at-least/
Its a common misconception that as MongoDB does not use SQL it is not vulnerable to SQL injection attacks. PHP uses objects rather than SQL to pass queries to the MongoDB server; for example the following script selects an item form MongoDB where the username equals ‘bob’ and the password equals ‘password’.
"username" => $_GET['username'],
"passwd" => $_GET['passwd']
));
This is equivalent to the SQL syntax
WHERE username=" . $_GET['username'] . ",
AND passwd=" . $_GET['passwd'])
In a normal SQL injection attack we can replace either of the two input parameters with a string such that the SQL query always returns true. e.g.
That wont work with MongoDB; however if we can pass in an object to the PHP MongoDB driver we could alter the query in a similar fashion. Luckily PHP provides us with a way to pass objects as GET or POST parameters:
This creates the MongoDB query
"username" => "admin",
"passwd" => array("$ne" => 1)
));
Which is the equivalent to the following SQL statement which, unless the password is “1″ will always return true.
WHERE username="admin",
AND passwd!=1
The solution is to ensure your variables are properly typed before they are passed into the MongoDB driver. The following code is not vulnerable to MongoDB injection:
"username" => (string)$_GET['username'],
"passwd" => (string)$_GET['passwd']
));