The vulnerability in regularlabs.com Advanced Module Manager (Free, Pro) for Joomla involves the Conditions editor creating a default Condition Set name from the linked item. The affected code accepts database table and label-column names from user requests, quoting them as SQL identifiers but not restricting them to supported tables and columns. This allows an attacker with high privileges to select valid but unrelated database fields, resulting in exposure of sensitive database information. This is classified as an authorization failure (CWE-200) rather than an SQL injection. The affected versions include 9.0.0 through 12.0.4, 4.0.0 through 7.1.0, 11.0.0 through 14.1.0, and 12.2.0 through 16.1.0. No known exploits or patches are reported.

An attacker with high privileges can exploit this vulnerability to access sensitive database information beyond the intended scope by specifying arbitrary database table and column names. This leads to unauthorized disclosure of sensitive data. The vulnerability does not allow privilege escalation or code execution but compromises confidentiality of data accessible via the affected extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected Joomla extensions to trusted users only and monitor for unusual access patterns. Avoid exposing the affected modules to untrusted users. Follow vendor communications for updates on patches or mitigations.