Vulnerable MS-SQL database servers have external connections and weak account credentials, researchers warn.