Hacking victim Bit9 blames SQL injection flaw