on the bottom of the page:

Warning: INSERT command denied to user 'dbo325141527'@'74.208.180.97' for table 'bs_watchdog' query: INSERT INTO bs_watchdog (uid, type, message, variables, severity, link, ___location, referer, hostname, timestamp) VALUES (0, 'php', '%message in %file on line %line.', 'a:4:{s:6:\"%error\";s:12:\"user warning\";s:8:\"%message\";s:636:\"INSERT command denied to user 'dbo325141527'@'74.208.180.97' for table 'bs_accesslog'\nquery: INSERT INTO bs_accesslog (title, path, url, hostname, uid, sid, timer, timestamp) values('Cybersecurity For The 21st Century, Hacking Challenge: Change this website's homepage picture and win $10K and a position working with Senior Cybersecurity Advisor, Joe Black. DONE, THAT WAS EASY. KEEP YOUR MONEY WE DO IT FOR THE LULZ', 'node/1', 'http://news.ycombinator.com/item?id=2639058&#039 in /homepages/6/d325020610/htdocs/includes/database.mysql.inc on line 128

It's the referer.

Yep it's clearly the access logger, but it's database password got changed by the attacker.

The other day an editor at work was complaining that a link they added only worked when visited directly, not when clicked. It turned out the target site had an access logger that synchronously downloaded the referring page, got its title, and then attempted to insert the title into its DB - without escaping it of course. Our post linking to the target site had an apostrophe in its title...