Burp suggests that there is a reflection.. It changes a value of a cookie named as x as x=<script src=abc.js>
and in response this value gets injected to a javascript function..
<script type="text/javascript">
fnUseX('arg1','<script src=abc.js>');
</script>
I tried a few scripts and looks like characters such as / and ;
are blocked.
Does this confirm the presence of cross site scripting? How we could actually exploit it? Are there any HTML5 XSS vectors which could be tried here?