I have a question regarding XSS in eval. Normally, eval XSS is pretty straight forward, however this is stumping me.
This particular application takes data from a form field, and put it into the following variable assignment:
var value = eval(form.pymt.value * 12);
Where pymt is the controlled input.
Now, at first I saw this as simple, with multiple methods of execution:
); eval(alert(1));// alert(1));// etc.
Buuuut, this isn't the case. From what I understand, anything that's applied to the form value of pymt is going to be multiplied by 12. However, I'm a little confused, as there have been many occasions where I have been able to comment out trailing code, but this is not the case in this scenario.
I'm wondering why the injected code is not being accepted as anything more than the pymt value as string, and if there is any way around this? Hopefully this question isn't too vague or off topic in any way, and folks can educate me on exactly what's happening.