Security hole found in Microsoft's SQL Server