Lab 37 — WriteFlow — NoSQL Injection via Nested $where in Mongoose Populate

hackadvisor

Task: Node.js/Express blogging platform using MongoDB/Mongoose with server-side author role filtering in populate() match conditions, and a JSON-accepting authorFilter parameter. Solution: inject {\"role\":\"admin\"} via authorFilter to override the default role exclusion in Mongoose populate match, revealing hidden admin-only posts containing the flag.