I had a similar hack on one of my sites on Saturday. They uploaded something and managed to get onto the server and upload a set of Paypal phishing pages and images. I only found out because Paypal contacted me!!I’m guessing they exploited an image upload script I had.