I have found a XXS vulnerability, but I am not able to exploit it. My input, 66038');}confirm(1);/*
, appears two times. The idea was to close the function foo1()
and trigger confirm(1)
. But foo2
is the problem. It is not possible to initialize foo_var
with the same payload. The character )
is the problem. Any ideas?
function foo1(){
if('EUR66038');}confirm(1);/* != 'blabla'
/*
Some comments
*/
function foo2()
{
var foo_var= 'EUR66038');}confirm(1);/* //Comment
...