functions.php got injected malicious script

in this theme functions.php file i got injected an upload form to uplad any file (like .php) so its malicious code. not sure how it was injected. (original theme is ok, but not sure if it has any hole or what)