PodcastGenerator 3.2.9 Cross Site Scripting

# Exploit Title: PodcastGenerator 3.2.9 - Stored XSS 
    # Date: 2026-08-08
    # Exploit Author: Sahil Arya
    # Vendor Homepage: https://github.com/PodcastGenerator/PodcastGenerator
    # Software Link: https://github.com/PodcastGenerator/PodcastGenerator
    # Version: 3.2.9
    # Tested on: Windows 11 / XAMPP
    # CVE : CVE-2025-70336
    
    Description:
    PodcastGenerator 3.2.9 contains a stored Cross-Site Scripting
    vulnerability in the Live Items functionality.
    
    An authenticated administrator can inject JavaScript through the
    TITLE, SHORT DESCRIPTION, or LONG DESCRIPTION parameters. The
    payload is stored and subsequently executed when the Live Item is
    rendered in both the administrative Live Items listing and the
    public Live Stream page.
    
    Administrative privileges are required only to store the payload.
    Unauthenticated access is sufficient to trigger the stored payload
    through the public Live Stream page.
    
    Proof of Concept:
    
    1. Log in to the PodcastGenerator administrator panel.
    
    2. Navigate to:
    
       /admin/live_create.php
    
    3. Insert the following payload into TITLE, SHORT DESCRIPTION,
       or LONG DESCRIPTION:
    
       <script>alert(document.domain)</script>
    
    4. Save the Live Item.
    
    5. Navigate to:
    
       /admin/live_list.php
    
       The JavaScript payload executes.
    
    6. Open the public Live Stream page as an unauthenticated user:
    
       /live.php
    
    7. The same stored payload executes in the visitor's browser.
    
    References:
    
    CVE:
    https://www.cve.org/CVERecord?id=CVE-2025-70336
    
    NVD:
    https://nvd.nist.gov/vuln/detail/CVE-2025-70336
    
    Advisory:
    https://github.com/aryasahil96-manu/CVE-Disclosures/blob/main/CVE-2025-70336