I looked at the code briefly and I noticed a few things you should concern yourself with.

Here's a code snipped from the index.pl:

 my $User = $CommonObject{ParamObject}->GetParam(Param => 'User') || '
+';
    my $Pw = $CommonObject{ParamObject}->GetParam(Param => 'Password')
+ || '';
[download]

I don't know about you but this seems like a hell of a lot of overhead to get a darn username and password! The CGI stuff should be a higher level object rather than nested down so far. Looking randomly at other code makes me think that OO programming went to some kind of extreme here. Perhaps the developers are used to another language?

Also, if I am right and the index.pl file is the starting point for this program (didn't have enough time to read the DOCS, sorry!) then it is NOT running in taint mode, which is not a problem if you are doing all of the stuff that taint mode insists that you do, but somehow I don't think that it is the case here. You are welcome to check for youself though.

#!/usr/bin/perl -wT
  #where art thou?
[download]

Lastly, there are tons of .DTL files which looks like some kind of proprietary version of Embperl. I probably would have just used Embperl instead unless there was a good reason not to use it.