SQL injection threat detected on farcry site security scan

Hi,

We have an old FarCry 5.2.7 site. A recent WAS security scan reported some
SQL injection threats around webtop login area:

Detection Information
Parameter It has been detected by exploiting the parameter
*farcryFormValidation* of the form located in URL
http://thewebsite/farcry/core/webtop/login.cfm?
returnUrl=/index.cfm
The payloads section will display a list of tests that show how the param
could have been exploited to collect the information

Payloads
#1 Request
Payload
FarcryFormPrefixes=login&loginObjectID=E8C4D550-6FBE-11E3-AFD63C4A926C9186&loginTypename=farLogin&lo
ginusername=John&loginpassword=John&FarcryFormSubmitButton=1234&FarcryFormSubmitButtonClickedfarcryF
orm444678179=1234&FarcryFormSubmitted=farcryForm444678179&SelectedObjectID=1234&farcryFormValidation
=1%22'%3E%3Cqss%3E&FarcryFormsubmitButton
%3DLog%20In=Log%20In
Request POST
http://thewebsite/farcry/core/webtop/login.cfm?returnUrl=/index.cfm

Same SQL injection threats also reported on:

*SelectedObjectID*

*FarcryFormSubmitted*

*FarcryFormSubmitButton*

*loginpassword*

Can anyone please point us to the right direction about how to fix this?

Thanks


-- 
Best regards,

Xiaofeng,^_^

-- 
You received this message cos you are subscribed to "farcry-dev" Google group.
To post, email: farcry-dev-/[email protected]
To unsubscribe, email: farcry-dev+unsubscribe-/[email protected]
For more options: http://groups.google.com/group/farcry-dev
--------------------------------
Follow us on Twitter: http://twitter.com/farcry
--- 
You received this message because you are subscribed to the Google Groups "farcry-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to farcry-dev+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
For more options, visit https://groups.google.com/groups/opt_out.