SIP is a free Raspberry Pi based Python program for controlling irrigation systems (sprinkler, drip, hydroponic, etc). It uses web technology to provide an intuitive user interface (UI) in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile devices. SIP has also been used to control pumps, lights, and other Irrigation related equipment.
The application performs state-changing actions through HTTP GET requests without including any anti-CSRF token or validating the request origin. This can be exploited to perform administrative actions such as disabling the passphrase, rebooting the device, deleting programs or installing plugins if a logged-in administrator is lured into visiting a malicious web page. When the optional passphrase is not enabled (factory default) these actions are additionally available to any unauthenticated user, and where the passphrase is enabled it defaults to 'opendoor'.