How does this work

Hello,
I tested this script, but as i can see it works only if there is no password set for the admin interface.
But in that case this isn't really an exploit. Its easier just to log in and create such an account.

Can you provide me some information about this?