diff --git a/modules/exploits/linux/http/majordomo_cmd_inject_cve_2023_50917.rb b/modules/exploits/linux/http/majordomo_cmd_inject_cve_2023_50917.rb
index a3f1aa1176e6..1dea113f349e 100644
--- a/modules/exploits/linux/http/majordomo_cmd_inject_cve_2023_50917.rb
+++ b/modules/exploits/linux/http/majordomo_cmd_inject_cve_2023_50917.rb
@@ -67,7 +67,7 @@ def send_request_with_auth(uri, method: 'GET', vars_get: {}, vars_post: {})
   end
 
   def majordomo?
-    favicon_uri = normalize_uri(datastore['TARGETURI'], '/favicon.ico')
+    favicon_uri = normalize_uri(datastore['TARGETURI'], 'favicon.ico')
     res = send_request_with_auth(favicon_uri)
 
     if res.nil? || res.code != 200
@@ -102,6 +102,6 @@ def check
 
     return CheckCode::Unknown if res.nil?
 
-    res.code == 200 ? CheckCode::Safe : CheckCode::Vulnerable
+    res.code == 200 ? CheckCode::Vulnerable : CheckCode::Safe
   end
 end