- Application responds to request to a particular URL with
- JSON response contains a parameter from the request
- Escapes the quote with a slash
- Doesn't do an eval on response
- Responds to requests which do not have
X-Requested-With: XMLHttpRequest(i.e. if you directly paste the URL with parameters in the address bar)
Is there a way to do a successful XSS on the application?
Please feel free to edit the question if it is not clear