Using xss to fall into the background of Baidu Complaint Center

If the use of XSS is as simple as that of NBSI, The results may be different.
Speak with facts.
One fact we need to know is that many large Internet enterprises have a very good front-end protection, but no one will choose the best protection. For the front-end, the background is easy to ignore. Although we do not know the structure of the background program, we can speculate based on the nature of some functions, for example, the customer service feedback system is short for Internet companies' security.
 
Target address:
Http://tousu.baidu.com
Proof of vulnerability: Find a product complaint page, such as a library, and directly submit the "> <xss code> <code like this to make a simple form.
 
 
 
If you are lucky to submit the ticket .....
 
 
After accessing the background address, it is actually accessible from the Internet. The cookie is used to hijack the session.
 
 
 
 
 
 
There is also the top-level editing function, leaving a footprint
 



 
 
 
Solution:
The backend should not be open to the public network. In addition, output escaping is required for information presentation.
 
Cookie global httponly?