[just2n]

I've never exposed a Postgres or MySQL database directly to the internet, either. They're always listening to localhost connections only, and the only code that gets to make direct calls into them is my code, which means input sanitization prevents attacks like this.

The same goes for my use of MongoDB.

Though I am curious if anything similar exists for CouchDB, as they seem to be encouraging dangerous configurations like that.

[rambot]

Same. I was trying to suggest the attack vector most people would encounter is the web application MongoDB is servicing.