SIP is a free Raspberry Pi based Python program for controlling irrigation systems (sprinkler, drip, hydroponic, etc). It uses web technology to provide an intuitive user interface (UI) in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile devices. SIP has also been used to control pumps, lights, and other Irrigation related equipment.
SIP executes user-configured operating-system commands when an irrigation station changes state, if the optional cli_control plugin is installed and enabled. This can be exploited to run arbitrary commands on the affected host by storing a command through the plugin's HTTP endpoint and then activating the associated station. When the optional passphrase is not enabled (factory default) both steps require no authentication, and where the passphrase is enabled it defaults to 'opendoor' and the same result is reachable through cross-site request forgery.