We should check for a specific random value here for `rand_arg`. Using a unique value ensures, only this module run can execute the payload. You can also use a HTTP Header instead of the GET parameter to be "log file stealth".
See here for an example:
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/php_wordpress_total_cache.rb#L81