If someone had a website that said "My server's code is law. You can do whatever it lets you do." And you found an sql injection vulnerability I would think you'd be allowed to mess with it.