Pligg CMS is a CMS written in PHP language and licensed under GPL v 2.0. In Pligg CMS panel in adding page section, Pligg CMS allows the admin to add PHP codes in {php} {/php} tags. A CSRF vulnerability in adding page section allows the attacker to execute PHP codes on the server. In this exploit, a 'echo '<h1> Hacked </h1>';' code is added. After the HTML file is executed, the page can be accessed at http://localhost/pligg-cms/page.php?page=Hacked.