I've been playing around with Nosql and specifically MongoDB injection on a few challenges and my lab. If you have an injection point you can easily enumerate and dump the database. But can you go beyond that, like the many things you can do with a SQL injection?
More specifically, is there any way to read or write files on the server from a MongoDB injection?
My Google search for that returned empty-handed so I looked at the mongo Database Commands but I didn't see anything obvious there that could be leveraged to read/write to arbitrary files.