How does this NoSQL injection work Information Security Stack Exchange