Find a security issue and win 2000 euros

In September, 2006, Penny Samara and Stelios Asmargianakis released the first version (0.1) of Guru CMS, a Content Management System. One of their primary motivations for developing Guru CMS was the notorious insecurity of the "most common" open source Content Management Systems. Unlike other CMS which release every month security patches, Guru CMS was designed to be secure in today's hostile Internet environment. It does nothing as setuid root and is optimized with speed and security in mind.
It is also small (around 20MB) and simple to use, yet surprisingly powerful, and was coded with almost fanatical care to avoid security pitfalls.

Now that Guru CMS version 0.5 is available, we're offering a cash prize (currently 2000 euros) to the first person or group to find a security bug in Guru CMS.

Rules

1.To qualify for the prize, the bug must be in the current release of guru CMS at the time a claim is filed. For example, if a bug is discovered in 0.5 after a subsequent release, but the bug is fixed in the new release, it's disqualified.

2.Bugs that qualify for the prize, subject to the other conditions outlined in these rules, must be one of the following:
Remote exploits that give login access.
Local or remote exploits that grant admin privileges.
Local or remote PHP exploits that grant read or write access to a file the user can't normally access.
SQL injection/exploits.

3.Claims will be tested on a system with a minimal Guru CMS configuration based on the README.txt file included with the Guru CMS.

4.To submit a claim, details must be sent via our ticket system at https://guru-host.eu/client. Claims will be evaluated in the order received. Entries will be acknowledged by return e-mail. The committee will not be responsible for unacknowledged entries. The committee will evaluate claims within thirty (30) days of confirmed receipt of submission.

5.The Committee disclaims all liability for anything related to the contest. The Committee will not award the prize to anyone who causes any disruption in service to any system that is not the responsibility of the claimant. We recommend that all testing be done on systems dedicated to that purpose and not on public web sites/servers.

6.These rules can be modified at any time by The Committee. Rules changes will be announced on our Network status page at www.status-guru-host.com. Claims will be evaluated against the most recently announced rules at the time the claim is received by The Committee.

7. The issue should not be related with external authentication schemes like OpenLDAP which is currently fully supported via Guru CMS.