SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search bar.
**Describe the bug**
XSS in search bar

**To Reproduce**
Steps to reproduce the behavior:
1. Go to the website and make sure it has more than 10 bibliography/books
2.  put this payload (`<IMG SRC="jav&x09;ascript:alert('XSS');"><script>alert("xss by 0xdc9");</script>`) in the search bar and enter
3. an alert that said "xss_by_0xdc9" should pops


**Screenshots**

<img width="1440" alt="Screen Shot 2022-08-10 at 01 35 40" src="https://user-images.githubusercontent.com/46653986/183736842-e3d69a1c-8a89-4f27-88ac-c21f0a075b51.png">

<img width="1440" alt="Screen Shot 2022-08-10 at 02 23 15" src="https://user-images.githubusercontent.com/46653986/183744266-c064d591-63ce-487e-ac69-fb5300f81196.png">

**Desktop:**
 - OS: MacOS Mojave 10.14.6
 - Browser: Google Chrome | 103.0.5060.134 (Official Build) (x86_64)
 - Slims Version: slims9_bulian-9.4.2

XSS in search bar
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : XSS in search bar
Issue date:

--- start body ---
**Describe the bug**
XSS in search bar

**To Reproduce**
Steps to reproduce the behavior:
1. Go to the website and make sure it has more than 10 bibliography/books
2.  put this payload (`<IMG SRC="jav&x09;ascript:alert('XSS');"><script>alert("xss by 0xdc9");</script>`) in the search bar and enter
3. an alert that said "xss_by_0xdc9" should pops


**Screenshots**

<img width="1440" alt="Screen Shot 2022-08-10 at 01 35 40" src="https://user-images.githubusercontent.com/46653986/183736842-e3d69a1c-8a89-4f27-88ac-c21f0a075b51.png">

<img width="1440" alt="Screen Shot 2022-08-10 at 02 23 15" src="https://user-images.githubusercontent.com/46653986/183744266-c064d591-63ce-487e-ac69-fb5300f81196.png">

**Desktop:**
 - OS: MacOS Mojave 10.14.6
 - Browser: Google Chrome | 103.0.5060.134 (Official Build) (x86_64)
 - Slims Version: slims9_bulian-9.4.2

--- end body ---

The issue describes a Cross-Site Scripting (XSS) vulnerability in the search bar of the application. An attacker can inject malicious JavaScript code through the search input, which is executed in the context of the user's browser, leading to potential data theft or session hijacking.