diff --git a/modules/exploits/multi/http/oscommerce_installer_unauth_code_exec.rb b/modules/exploits/multi/http/oscommerce_installer_unauth_code_exec.rb index bd3cdb950a..c1aeaa790e 100644 --- a/modules/exploits/multi/http/oscommerce_installer_unauth_code_exec.rb +++ b/modules/exploits/multi/http/oscommerce_installer_unauth_code_exec.rb @@ -51,7 +51,12 @@ class MetasploitModule < Msf::Exploit::Remote 'method' => 'GET' }) - if res and res.code == 200 and res.body.include?('Welcome to osCommerce Online Merchant v2.3.4!') + ins = send_request_cgi({ + 'uri' => normalize_uri(datastore['URI'], 'install.php'), + 'method' => 'GET' + }) + + if ins && ins.code == 200 && res && res.code == 200 && res.body.include?('Welcome to osCommerce Online Merchant') return CheckCode::Vulnerable end