Superfund

We're trying to educate the world about environmental justice and built a new site, but our admin followed a link sent by a hacker, and then the hacker got access to sensitive admin functionality. Can you figure out how they did it so we can stop it from happening again? Our developers tried and couldn't figure it out, but they did leave some comments in the source along the way. You can submit links to our admin here. The source code for the site is available as well.