PHP default_charset is none

The newer PHP versions from version 5.6 have set default_Charest as UTF-8. There are many servers using PHP default charset as empty. The default character encoding is used for encoding and decoding HTML entities, HTML special character functions. The value of default_charset will also be used to set the default character set for iconv functions encoding and decoding. Setting default_charset to an empty value is not recommended. This encoding affects htmlentities(), html_entity_decode() and htmlspecialchars(). This is also used for iconv functions too.

Impact

Using this vulnerability, an attacker can:-

• manipulate HTTP server-side settings.

Mitigation / Precaution

Beagle recommends the following fixes:-

• Try to use UTF-8 in charset declarations.
• Make sure the web application is using a whitelist of accepted charsets if the application wants to control the charset.

Written by

Sooraj V Nair

Cyber Security Engineer

Sooraj was probably the kid who opened up a remote control just to see what was inside, then had to figure out how to put it back together before anyone noticed. That curiosity eventually found its way into cybersecurity, where breaking things is actually part of the job description. Today, he explores vulnerabilities, analysis threats, and helps build safer digital spaces. His favourite question remains the same: “What happens if I try this?”