Alexandr Polyakov and Anton Karpov have reported a vulnerability in OpenBSD bgplg, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input via the "cmd" parameter to the bgplg cgi-bin script is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in OpenBSD 4.1 and confirmed in OpenBSD 4.2.

Solution
Filter malicious characters and character sequences using a web proxy. Fixed in CVS repository.
Further details available to Secunia VIM customers

Provided and/or discovered by
Alexandr Polyakov and Anton Karpov, Digital Security Research Group

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.mail-archive.com/misc@openbsd.org/msg49057.html
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/bgplg/bgplg.c

Deep Links
Links available to Secunia VIM customers