Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component pop_chart.php.
**Describe the bug**
A Cross site scripting due to unfiltered `$_GET['filter']`

**To Reproduce**
Steps to reproduce the behavior:
1.   Log in as Admin
2.  Go to http://localhost/admin/modules/reporting/pop_chart.php?filter=2022%20%27<script>alert(%270xdc9%27);</script>
3.  There should be a pop that says '0xdc9'

**Screenshots**
![image](https://user-images.githubusercontent.com/46653986/196026667-f0047462-f2ee-454d-81d5-73179ceca21e.png)


**Versions**
 - OS: Kali Linux(Debian) 2021
 - Browser: Firefox 78.7.0.esr(64-bit)
 - Slims Version: slims9_bulian-9.4.2

**Vulnerable code**
- pop_chart.php line 43-70

[Security Bug] XSS in pop_chart.php
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : [Security Bug] XSS in pop_chart.php
Issue date:

--- start body ---
**Describe the bug**
A Cross site scripting due to unfiltered `$_GET['filter']`

**To Reproduce**
Steps to reproduce the behavior:
1.   Log in as Admin
2.  Go to http://localhost/admin/modules/reporting/pop_chart.php?filter=2022%20%27<script>alert(%270xdc9%27);</script>
3.  There should be a pop that says '0xdc9'

**Screenshots**
![image](https://user-images.githubusercontent.com/46653986/196026667-f0047462-f2ee-454d-81d5-73179ceca21e.png)


**Versions**
 - OS: Kali Linux(Debian) 2021
 - Browser: Firefox 78.7.0.esr(64-bit)
 - Slims Version: slims9_bulian-9.4.2

**Vulnerable code**
- pop_chart.php line 43-70

--- end body ---

A Cross-Site Scripting (XSS) vulnerability exists in the pop_chart.php file due to the unfiltered use of the `$_GET['filter']` parameter. An attacker can exploit this vulnerability by injecting malicious scripts into the URL, which can then be executed in the context of the user's browser, potentially leading to session hijacking or other malicious actions.