Saif,
All I know is that the application was written in PERL CGI .
So maybe there is something in PERL/CGI that would allow access to clients file path.
I see, I'll take a look at it just for knowledge purposes.
It used to be the case that Internet Explorer would upload the whole path, instead of just the file name. Other browsers don't do that, because of the security risks referred to in an earlier post. Perhaps recent versions of IE have fixed this problem -- I don't know because I haven't checked.
Perhaps your clients were all IE users?
Yes Paul , I can say about the older versions of IE ( prior to 7 ) , they used to send the complete physical address of the clients file system instead of just the file name although I am also not sure about the newer versions of IE. Maybe Mathew's was a very particular scenario where all clients were supposedly using an old IE version.