Verifying one specific attack vector of Cross Site Scripting

Question

Burp suggests that there is a reflection.. It changes a value of a cookie named as x as x=<script src=abc.js> and in response this value gets injected to a javascript function..

<script type="text/javascript">
fnUseX('arg1','<script src=abc.js>');
</script>

I tried a few scripts and looks like characters such as / and ; are blocked. Does this confirm the presence of cross site scripting? How we could actually exploit it? Are there any HTML5 XSS vectors which could be tried here?

Answer 1

This looks like it could be exploited using a cookie value like this

</script><script>alert(1)</script>

Try setting it manually and see if it fires the alert.