Analyze PHP project source code, identify how user input enters NoSQL query conditions, and detect authentication bypass/data leakage caused by operator injection.
Severity Rating and Numbering
- See:
shared/SEVERITY_RATING.md - Vulnerability ID:
{C/H/M/L}-NOSQL-{序号}
Mandatory Sinks (Required)
Commonly found in MongoDB drivers/ODMs:
collection->find($filter)findOne($filter)/update($filter, {value})/delete($filter)where($condition)or->filter({value})- Wrapper functions that splice user input into query arrays/expressions
Mandatory Dangerous Patterns (Required)
The following judgment evidence must be output:
- User input directly used as part of a filter/condition array (especially the result of
json_decode) - Behavior exists where "user input is treated as a structured condition" without forced typing/allowlisting
- The query contains operator fields that may be abused:
$ne/$gt/$lt/$or/$and/$where/$regex
tracer Trigger Conditions
When user input is JSON/array/nested structure and there are multiple layers of wrapping before entering query construction, the final sink must be traced.
Report Output
{output_path}/vuln_audit/nosql_{timestamp}.md
Entry Template (Required)
Each vulnerability must include:
- Location evidence (query construction function/final find/update call)
- Data flow chain (input parsing -> type -> query condition)
- Exploitable preconditions (authentication state/requires login or not/whether query operators can be changed)
- Verification PoC (must use real routes and real parameter names; payload is a structured NoSQL condition example)
- Remediation recommendations (strict field allowlist + forced typing + avoid treating user input as query expressions)
Evidence Citation (Required: from php-route-tracer)
Each suspected NoSQL injection vulnerability must cite item by item from the trace output the ## 9) Sink Evidence Type Checklist of NOSQL linesCorresponding evidence points (status may be pending verification, but evidence citations must exist):
EVID_NOSQL_QUERY_CONSTRUCTION: NoSQL query construction point evidence (corresponding to find/update/delete or query builder execution point)EVID_NOSQL_USER_INPUT_INTO_QUERY_STRUCTURE: Evidence of user input entering the query condition structure (controllable fields entering the filter/where structure)EVID_NOSQL_OPERATOR_INJECTION_FIELDS: Operator injection field evidence ($ne/$gt/$or/$where/$regex, etc.)
Handling of Missing tracer Evidence (Required)
- If any of the above 1~3 key evidence points cannot be located: the vulnerability status can only be marked as
⚠️待验证, and directly giving✅已确认可利用。