I assume that you have a modern installation of Drupal and all the modules that you use installed. This is the most important thing you need to be sure about - stay tuned for Drupal and always update it after a security update is released.
However, it is much more likely that this is one of your modules that has a security flaw, not the Drupal core. Drupal had (and probably still) flaws, but the really nasty problems were usually in the modules.
The reason for this is that the modules are usually written by third parties who may or may not well understand good security practice. And while the kernel is used by everyone and attracts the attention of developers, most modules will not have such widespread use, so they get less development work, less testing and less use, so errors are less likely to be noticed.
Look at the non-core modules that you used for your site (this can help change your question to list them here, in case someone knows something specific).
Use Google to search for drupal modulename security or something similar, and see what happens. Also visit their pages on drupal.org and read the notes there; look how active the project is - when was the last module updated? and how often? how many developers worked on this? etc. - if these numbers are low, consider finding an alternative module to do the same job.
If your PHP skills are good enough (and you have the time), you can review the code to see if you can see anything.
Of course, this may not be a problem with drupal. If you are on a shared hosting platform, the box may have been compromised by a security problem on any of the hosted sites, as a result of which all the sites on the box were compromised (this happened to me alone - not very well). But since the code that was entered is specific to drupal, it looks like it could be a drupal hack, so the main suspect should remain your installation.
Hope this helps.