Mass Assignment vulnerability can be exploited by Ruby on Rails, NodeJS, Spring MVC, PHP and Mongoose. It can be used to bind HTTP request parameters into program code variables or objects to make using that framework easier on developers. This can sometimes cause harm. Attackers can sometimes use this methodology to create new parameters that the developer never intended. In 2012, GitHub was hacked using mass assignment. A user was able to upload his public key to any organization and thus make subsequent changes in their repositories.”]
Source: https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html