CVE-2019-8424 (zoneminder)

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter.

Source: CVE-2019-8424 (zoneminder)