Business Logic Error in Omega Solution Restro POS

Executive Summary

CVE-2026-116461 is a Business Logic Vulnerability in Omega Solution Restro POS that allows price manipulation during sale invoice creation. The application accepts client-supplied product prices without validation, enabling attackers to set arbitrary prices for products. This occurs because the server processes the manipulated price without verifying it against the actual product price stored in the database.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to /sale-invoice/ with manipulated productUnitSalePrice values. Use tools like Burp Suite to intercept and inspect HTTP requests. Check server logs for abnormal pricing discrepancies or invoice totals that do not match official product prices.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to financial loss as products can be purchased for significantly less than their legitimate price. Attackers can modify invoice totals, underpay for expensive items, generate fraudulent invoices, manipulate profit calculations, corrupt accounting reports, abuse promotional mechanisms, and circumvent pricing controls. The impact is severe, especially in environments where cashiers or customers can create invoices.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately remove productUnitSalePrice from client-controlled input. Ensure the server fetches official product prices using productId from the database. Validate all invoice totals server-side before processing payments. Log abnormal pricing discrepancies for fraud detection.

Useful 0 Not Useful 0