A logical flaw in Omega Solution Restro POS allows a remote attacker to alter the productUnitSalePrice value when submitting a sale invoice. The manipulated value can cause incorrect invoice totals, jeopardizing the accuracy of sales records and potentially leading to financial losses. The flaw does not grant system control but directly undermines transaction data integrity.

The vulnerability exists in Omega Solution Restro POS releases dated up to 2026‑10‑26. Any installation of Restro POS whose last release date is earlier than or equal to that date is potentially affected. No specific sub‑versions are listed, so organizations should assume all content under the product is vulnerable until a patch is applied.

The CVSS score of 5.3 indicates a medium level of severity with moderate complexity. EPSS data is not available, so the exploitation frequency is unknown, but the vulnerability has been publicly disclosed and can be exploited through the sale‑invoice endpoint from a remote location. It is not listed in the CISA KEV catalog, suggesting it has not yet reached widespread recognition as a high‑risk exploit. The likely attack vector is remote web exploitation; an attacker must send a crafted request to the sale‑invoice interface with a manipulated productUnitSalePrice parameter.