Sustainable Irrigation Platform vulnerabilities

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin. An unauthenticated or CSRF attacker can store a malicious payload via the plugin's HTTP endpoint and then activate an irrigation station, leading to arbitrary OS command execution on the host.

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of a required passphrase in the default configuration or the default passphrase 'opendoor', to write arbitrary JSON files outside the intended data directory.

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a server-side request forgery (SSRF) vulnerability. An unauthenticated attacker can exploit the lack of destination validation and the default passphrase 'opendoor' to send blind HTTP requests to arbitrary internal or external hosts when the optional Node-RED plugin is installed.

The Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass assignment vulnerability that allows unauthenticated attackers to overwrite sensitive configuration settings by supplying arbitrary parameter names in HTTP requests. Attackers can manipulate parameters corresponding to sensitive values such as the passphrase and listening port, and can also achieve the same result through cross-site request forgery due to the absence of adequate request validation.

A CSRF vulnerability in Sustainable Irrigation Platform (SIP) through version 5.2.16 allows remote attackers to perform state-changing administrative actions by tricking a logged-in administrator into visiting a malicious page that issues HTTP GET requests without CSRF token validation or origin verification. The default configuration (no passphrase, default credential 'opendoor') exposes these endpoints to unauthenticated users.

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability. Unauthenticated attackers can inject arbitrary JavaScript by supplying malicious payloads within program names submitted via HTTP requests.