You should have no problem with CGI for POST unless you're being given garbage (e.g. being told you are provided something's that "application/x-www-form-urlencoded" when it isn't).

my $url;
if ($cgi->request_method eq 'GET') {
   # Can't use ->param('url') because the client is
   # providing the parameters in a stupid format.
   ( $url = $ENV{QUERY_STRING} ) =~ s/^.*[?&]url=//s;
} else {
   $url = $cgi->param('url');
}
[download]

If you are getting garbage, it can be handled. You've been given the link to the CGI spec. Read it. Your asking questions with no apparent effort at answering them yourself.

Is there an ENV which gives my the message body in case of a POST request?

       If POSTed data is not of type application/x-www-form-urlencoded or
       multipart/form-data, then the POSTed data will not be processed, but
       instead be returned as-is in a parameter named POSTDATA.  To retrieve
       it, use code like this:

          my $data = $query->param('POSTDATA');

But if it's CGI.pm that is causing you all this grief, consider not using CGI.pm. Using the CGI protocol (which is different from CGI.pm!), you get the POST data on STDIN.