header-logo
Suggest Exploit
vendor:
N/A
by:
N/A
4,3
CVSS
MEDIUM
Endless Loop
835
CWE
Product Name: N/A
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: CVE-2010-3899
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2010

Crawler endless loop (CVE-2010-3899)

The crawler has no recursion depth limit. A site with dynamic parameter manipulation can cause an endless loop. This loop will block the crawler thread and use permanent server resources. Too many blocks can lead to a denial of service. The same site will be indexed more times and the search results will display the same site many times. This can be abused for spamming the search results. Exploit to test the endless loop: /* loop.php */ <?php $numb = rand(); echo $numb.'<br><a href="loop.php?value='.$numb.'">click me</a>'; ?>

Mitigation:

Implement a recursion depth limit for the crawler.
Source

Exploit-DB raw data: