The newer PHP versions from version 5.6 have set default_Charest as UTF-8. There are many servers using PHP default charset as empty. The default character encoding is used for encoding and decoding HTML entities, HTML special character functions. The value of default_charset will also be used to set the default character set for iconv functions encoding and decoding. Setting default_charset to an empty value is not recommended. This encoding affects htmlentities(), html_entity_decode() and htmlspecialchars(). This is also used for iconv functions too.
Using this vulnerability, an attacker can:-
Beagle recommends the following fixes:-