Bots are attacking multiple sites using the compare product functionality.
See Bot attack on: Allow customers to compare products: CPU 100%? for description.
Requested solution is to turn the compare product feature into a post request rather than html link.
In the mean time the easiest fix for anyone reading this is to turn off the product compare feature settings/general/untick allow customers to compare.
on further investigation, turning off the setting pending a fix isn’t a complete solution because the setting is used mainly by templates to hide buttons and links. A direct request to product_features.add_product still reaches the frontend controller even after comparison is switched off. UniTheme (and I assume other themes, but this is what I use) also has several compound display conditions involving product.feature_comparison, so hiding every button should be verified rather than assumed.
Hello!
Thank you for informing us about this issue.
We already have a task for our development team to systematically address this class of problems. The goal is to refactor the codebase so that controllers no longer make direct database queries. This fix will be included in one of the future CS-Cart versions.
Thank you.