Fixing false positives Officeconnect RCE

routersploit/modules/exploits/3com/officeconnect_rce.py

@@ -7,6 +7,7 @@ from routersploit import (
     http_request,
     mute,
     validators,
+    random_text,
 )
 
 
@@ -65,11 +66,14 @@ class Exploit(exploits.Exploit):
     def check(self):
         url = "{}:{}/utility.cgi?testType=1&IP=aaa".format(self.target, self.port)
 
-        response = http_request(method="GET", url=url)
-        if response is None:
+        response1 = http_request(method="GET", url=url)
+        if response1 is None:
             return False  # target is not vulnerable
 
-        if response.status_code == 200:
+        if response1.status_code == 200:
+            url = "{}:{}/{}.cgi".format(self.target, self.port, random_text(32))
+            response2 = http_request(method="GET", url=url)
+            if response2 is None or response1.text != response2.text:
                 return True  # target is vulnerable
 
         return False  # target is not vulnerable