Maxcms (Maxcms) admin_inc.asp SQL injection vulnerability and repair

In the admin/admin_inc.asp file:
Sub checkPower // 103rd rows
Dim loginValidate, rsObj: loginValidate = "maxcms2.0"
Err. clear
On error resume next
Set rsObj = conn. db ("select m_random, m_level from {pre} manager where m_username = '" & rCookie ("m_username") & "'", "execute ")
RCookie function in file inc/CommonFun. asp
Function rCookie (cookieName) // www.2cto.com row 28th
RCookie = request. cookies (cookieName)
End Function
The rCookie function only reads data from cookies without any filtering, resulting in cookie injection vulnerability.
<* Reference
Refer to official patches
*>
Test method: Modify cookie value Injection

----
Solution: Filter Single quotes

From: 3est.com