If a guy forces the sv_allowcslua cvar, can he use sv side scripts?

[Karma]

Because I saw a guy on a server who did some kind of injection (I don't know how to call it), that
make that each player had things that fell on him (I spare the details). So I was wondering if a
player who force this cvar can run script on the server , Like : lua_openscript and not
lua_openscript_cl? Thanks for reading !

[Psycommu]

sv_allowcslua only allows ClientSide lua, as the name implies.

If they were running serverside code, you have a backdoor in one of your addons.

[Karma]

Thank you for your answer! It torments me since yesterday, it's unfortunate that people allow themselves to put a backdoor in their addons workshop.