CodeAstro Real Estate Management System Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in CodeAstro Real Estate Management System version 1.0. The issue resides in the file 'feature.php', where the 'msg' parameter is not properly sanitized before being echoed back to users. This flaw allows attackers to inject and execute arbitrary JavaScript in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed immediately in the user's browser.

Reproduction

To reproduce this vulnerability, send a GET request to 'feature.php' with the 'msg' parameter containing unescaped JavaScript, such as a script tag including JavaScript code, or an image tag with an 'onerror' event. The injected script will execute in the context of the user's browser.