Post Made Community Wiki by Dexter Legaspi
source | link

Certainly the SQL injection attacks and other functional flaws in the application took precedence, but you can also "demonstrate" bad code quality and practices. With code metrics tools you can clearly demonstrate how bad is the code and show him how much this will it add up in cost for any future changes and bug fixing. I'm not familiar with .net environment but I'm sure there are several from which to pick up.