这种情况是否是误报呢？如果不是那应该如何利用？

[huantianxidizhubajie]

[MindPatch]

hello @huantianxidizhubajie, I don't speak the Chinese language but my answer is based on Google Translation
scant3r match with gid= in the response of the request in the output so you can try another Unix Shell commands like TimeBased payloads (; sleep 10 #) if the response time is bigger than 10 secs or equals 10 this means the vulnerability alert is valid
or you can try to call a callback host like interact.sh ( ; curl {BALLBACK_HOST} ) and see if any request comes from your target or not

if not please tell me to improve the RCE module in this project

best regards
@knassar702

[huantianxidizhubajie]

Based on the tests so far, it was a false positive. I tested the front page of a website, and logically this bug should not occur. In addition, the logic of judging purely from the value returned by response is not rigorous. What do you say, Sir?

[huantianxidizhubajie]

你好@huantianxidizhubaji，但我不会说中文，但我的回答是基于谷歌翻译的输出中的请求响应中的 scant3r匹配，因此响应时间大于10 这意味着泄漏警报是像你一样的， 或者尝试调用可以调用。gid=``; sleep 10 #``; curl {BALLBACK_HOST}

如果没有，请告诉我改进这个项目中的 RCE 模块

最好的问候 @knassar702

If the judgment through the command execution, similar to the SSRF can execute the corresponding response to determine, I think the effect will be better, and more obvious. In addition, I tested Sleep (10). In this case, the connection is slow due to the delay of the website itself or the existence of WAF, which will also have false positives.

[huantianxidizhubajie]

No deep climb？