Executive brief
Multiple Joomla extensions from Regular Labs contain a database access control flaw in their Conditions editor. An attacker can craft requests to read data from unrelated database tables and columns that should not be accessible. This could lead to exposure of sensitive site data, user credentials, or customer information stored in the Joomla database.
Technical details
The Conditions editor in affected Regular Labs extensions accepts database table and column names from user requests without proper authorization validation. Although the table and column names are properly quoted as SQL identifiers (preventing SQL injection), the code does not restrict which database tables and columns can be accessed. An attacker can specify any valid but unrelated database field to read data. The vulnerability requires network access to the vulnerable endpoint and affects Advanced Module Manager (Free, Pro) versions before 12.1.0, Conditional Content (Free, Pro) versions before 8.0.0, Content Templater (Pro) versions before 14.2.0, and ReReplacer (Pro) versions before 16.2.0. This is an authorization bypass rather than traditional SQL injection. Patched versions are available.
Affected products
- Regular Labs Advanced Module Manager Free, Pro < 12.1.0
- Regular Labs Conditional Content Free, Pro < 8.0.0
- Regular Labs Content Templater Pro < 14.2.0
- Regular Labs ReReplacer Pro < 16.2.0
Timeline
- 2026-09-14: disclosed