flawopen.com/Reference/MongoDB NoSQL Injection

Is MongoDB vulnerable to SQL-like injection?

Database Security Guide
Short answer

Yes. While MongoDB does not use SQL strings, it is vulnerable to Operator Injection. If an Express application parses JSON request bodies without type checking, an attacker can send an object like {"$ne": null} instead of a password string, logging in without knowing the password.

Vulnerable vs. Fixed Code

VULNERABLE: ACCEPTS UNTYPED OBJECT INPUT
// Attacker sends: { "username": "admin", "password": { "$ne": null } }
app.post('/login', async (req, res) => {
  const user = await db.collection('users').findOne({
    username: req.body.username,
    password: req.body.password // Evaluates to: { $ne: null } -> TRUE!
  });
});
FIXED: TYPE VALIDATION & SANITIZATION
// Enforce string primitives strictly
app.post('/login', async (req, res) => {
  if (typeof req.body.password !== 'string') {
    return res.status(400).send("Invalid input");
  }
  const user = await db.collection('users').findOne({
    username: String(req.body.username),
    password: String(req.body.password)
  });
});

Prevention Checklist