The login API sends this query in MongoDB: db.users.find({em…

The login API sends this query in MongoDB: db.users.find({email: $_POST[‘e’], password: $_POST[‘p’]}) An attacker sends: {“email”: {“$ne”: “”}, “password”: {“$ne”: “”}} They are logged in as the first user. What is this attack?