5k is not so much for this kind of huge vulnerability.

I mean with a "great" hack this guy could have made much more in a few hour, but let say it's a generous reward anyway :)