Possible Initial Attack Vector?

I have a site that has been hacked, I believe it may be related to the ‘pharma’ hack, but at this point I’m still digging and not sure. At the moment I am trying to establish the initial vector of attack and have found some suspicious code appended to hardcoded links on some pages. The query looks like this: ‘www.site.org/legit-url?phpmyadmin=ksdh8HUS34hdsf-98jsd’. Does anyone know what this query is trying to do? By the way though the query appears multiple places the value after ‘phpmyadmin=’ is always the same.

Thanks in advance.