I took the opportunity to even update the famous NodeGoat repo https://github.com/OWASP/NodeGoat/pull/286 so that people can get more familiar with that kind of mis-configuration issue. Really hope that helps