Authenticated command execution via unsanitized domain parameter

OS command injection in Pi-hole Web 3.3 and earlier allows remote authenticated users to execute commands through a crafted allowlist domain. The add.php and sub.php handlers interpolate the POST domain value directly into sudo pihole command strings passed to PHP exec(), so shell separators append attacker-chosen commands. A valid web-interface password or session token is required, and commands run as the web-service account, enabling data access, modification, or service interruption within that account's privileges.