The vulnerability in the Gotac Police Statistics Database System is an arbitrary file upload flaw that allows an unauthenticated attacker to place any file, including executable web shells, onto the server. This defect, classified as CWE-434, enables an attacker to execute arbitrary code with the privileges of the web application, potentially compromising the entire system, data, and surrounding network.

This issue affects all deployments of the Gotac Police Statistics Database System running versions earlier than 1.0.3. The vendor has released an update (1.0.3 or later) that removes the unsafe upload functionality, so systems still on older versions are vulnerable.

Based on the description, it is inferred that the flaw can be exploited remotely over the web interface without authentication. An attacker who can reach the upload endpoint can upload a malicious file, leading to arbitrary code execution. The CVSS score of 9.3 indicates critical severity, while the EPSS score of less than 1% suggests a low exploitation probability. The vulnerability is not listed in the KEV catalog, but the potential impact remains high.