SIP is a free Raspberry Pi based Python program for controlling irrigation systems (sprinkler, drip, hydroponic, etc). It uses web technology to provide an intuitive user interface (UI) in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile devices. SIP has also been used to control pumps, lights, and other Irrigation related equipment.
The application stores program names supplied through HTTP requests and later renders them into its web pages without proper output encoding. This can be exploited to execute arbitrary JavaScript in the browser of any user who views the affected pages by creating a program whose name contains a script payload. When the optional passphrase is not enabled (factory default) the malicious program can be created without authentication, and where the passphrase is enabled it defaults to 'opendoor'.