There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a similar attack?
Here is a good overall reference http://cwe.mitre.org/data/definitions/79.html
From Symantec's Candid Wueest:
"Any user who is logged into Facebook and visits a site that contains such an element will automatically post an arbitrary message to his or her wall. There is no other user interaction required, and there are no tricks involved, like clickjacking."
"Just visiting an infected website is enough to post a message that the attacker has chosen. Therefore it should be of no surprise that some of those messages are spreading very fast through Facebook. Some are posting links to infected websites, creating XSS worms that spread from user to user."
So the issue is related to neutralizing data input into web pages.
Of course, we now live in the internet era, so, there's a video for that!
It is almost 10 minutes long, complete with all the details you would like, reviewing the exploit code and its functionality.