It appears that the Free Help Desk software by Help Desk Reloaded leaves the install.php file in place post installation, allowing remote attackers to create accounts without any authentication or access.
804b6bf95c701fc3e436588dcb9bb2b6c18779f0bb612923c56a2ad5eb75b375