This vulnerability in Shafiq Digital Lottery allows attackers to upload files without proper restriction on file types, including potentially malicious web shells. The affected versions are from initial releases through 3.0.5. The issue enables attackers to place executable code on the server, which could be leveraged to gain unauthorized control over the system. No CVSS score is assigned, and no vendor advisory or patch information is currently provided.

Successful exploitation could allow an attacker to upload and execute arbitrary code on the affected web server, potentially leading to full system compromise or unauthorized access to sensitive data. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions, implement strict file type validation, and monitor for suspicious upload activity as interim mitigations.