Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php.
ampache ampache 3.8.3