Without CGI.pm, unfortunately. It sounds like a job for XML::Parser or some variant. If you know which XML application (SOAP, XML-RPC, or the like), you can use a more domain-specific module.

Saying, "It's XML, how do I know what to do with it" is like asking "I have a file on my computer, what do I do with it?" The XML part is only important in that there are tools that can break it apart into pieces. It's what those pieces mean and what you can do with them that makes all the difference.