The Modules Anywhere (Pro) extension for Joomla versions 1.5.0 to 9.0.5 enables additional attributes on a module tag to replace arbitrary parameters of the selected module by default. This override mechanism does not verify the author of the content containing the tag, leading to a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). The Joomla core Feed module's rssurl parameter is vulnerable because it accepts local file URLs and network URLs, which the server opens, enabling SSRF attacks.

An attacker with the ability to insert module tags can cause the server to make arbitrary requests to internal or external resources, potentially accessing sensitive internal services or files. The impact depends on how the selected module processes the overridden parameters, with the Joomla Feed module's rssurl parameter providing a concrete example of SSRF exploitation. This can lead to unauthorized internal network access or information disclosure.

No official patch or remediation is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the ability to add or modify module tags to trusted users only and monitor for suspicious usage of the rssurl parameter in the Joomla Feed module.