It feels like notepad and/or cmd isn't in your path. If it were in X, I'd guess it was a missing $ENV{DISPLAY}. Either way, you want system() == 0 or die, not ||. There are interesting security problems with almost everything in that CGI, but one thing that might help a smallish amount (maybe none) is system("cmd.exe", "/c", "notepad.exe") — where it might help is if there were ever a filename argument.

The obvious DoS is to make your system open notepad.exe a hilarious number of times, simultaneously using up your webserver's MaxChildren. exec "notepad" unless fork might help with the children, but not with the hilarious number of notepads.