Are you sure it's CGI.pm that messes up the query_string, or happens this already at the user agent?

Is there an ENV which gives my the message body in case of a POST request?

A few seconds with the CGI.pm manual page reveals:

       If POSTed data is not of type application/x-www-form-urlencoded or
       multipart/form-data, then the POSTed data will not be processed, but
       instead be returned as-is in a parameter named POSTDATA.  To retrieve
       it, use code like this:

          my $data = $query->param('POSTDATA');

You could have found this out for yourself.

But if it's CGI.pm that is causing you all this grief, consider not using CGI.pm. Using the CGI protocol (which is different from CGI.pm!), you get the POST data on STDIN.