Yes, you can get CGI.pm to work for you.

You just need to unescape the xml that you receive from the post, like this :

#!/usr/bin/perl
use CGI qw/unescape/;
use strict;

my $cgi = new CGI;

print $cgi->header;
my $xml = $cgi->param('xml');
print unescape($xml);
[download]

And your previous, own rolled, rigthly merlin steaming version ;^) would work if you had not forgoten the proverbial print "Content-type: text/html\n\n"; before trying to output the https error codes.