CVE-2018-14961

dl/dlsendmail.php in zzcms 8.3 has SQL Injection via the sql parameter...