0

We are developing a application in Dotnet MVC with mongodb as a database.

We use below mentioned query in order fetch the data from the database.

Controller code:

[Get("getmsg")]
Public HttpResponseMessage GetMsg(int id  = "", 

String msg = "" )

MongoDb Query:

Query.Or(Query.EQ("msg","'"+msg"'")

Execution of query:

Var info= new Processstart("mongodb.exe")
{
Argument = ..query ..
}
  1. Is this code is vulnerable to nosql injection attack?
  2. if yes, then how the attacker can exploit this vulnerability?
  3. What are the prevention mechanism to avoid noSQL injection?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.