Dangerous JS Functio eval() - PCI DSS ASV Scan issue

[luckyduck]

Replace potentially dangerous eval() call. Severity rating medium (CVSS Score 4.5). Creates issues with PCI DSS ASV scans.

[luckyduck]

Attack Vector Explanation:

The use of eval() directly executes JavaScript code from strings constructed with user-provided input. An attacker who controls or manipulates the value of me.opts.moptPayoneParamsLanguage can inject malicious JavaScript code, causing Cross-site scripting (XSS).

Example Attack: If an attacker sets:

me.opts.moptPayoneParamsLanguage = "en; alert(document.cookie);"

Then the original code:

//eval('Payone.ClientApi.Language.' + me.opts.moptPayoneParamsLanguage);

executes as:

Payone.ClientApi.Language.en; alert(document.cookie);

This attack triggers arbitrary JavaScript execution, potentially exposing sensitive data like session cookies, allowing unauthorized actions or account takeover.