In EL5/6 implementations the default moh is usually in /var/lib/asterisk/
In Wheezy it is in /usr/share/asterisk/
In either case, these directories are owned by root so no, you can't upload files directly to them from a web application, at least not without figuring out how to manage the privileges. However, there's nothing to stop you creating your own moh folder and putting it wherever you like (including www). Look at the documentation for musiconhold.conf in the asterisk documentation.
Whatever you do, you'll need to figure out the format and sample rate of the uploaded file and, if necessary, re-sample it or it won't playback; asterisk is quite finicky when it comes to audio file formats and sample rates. You can avoid some of that by insisting on mp3 files. The asterisk documentation advises against it (see
http://www.asteriskdocs.org/en/3rd_Edition/asterisk-book-html-chunk/additional_configuration_tasks-musiconhold-conf-file.html) but in practice, it seems to work OK.
Finally, you will need to reload moh after the change. This is known to be temperamental, sometimes even requiring a soft restart of asterisk itself.
All of these issues can be solved and automated (except maybe handling a restart). As you say earlier, Elastix and many of the other freePBX derivatives have some form of upload capability for moh. However, the main reason we haven't put anything into sail (at least for moh) is that I know how fragile the asterisk moh routines are and I know how easy it is to break them with bad sound files. If you do break them you'll likely need to stop and restart asterisk and I don't think your customer will thank you for that if it happens too often. Any general uploader runs the risk of exposing the PBX to potentially unknown stuff being loaded and processed by the Asterisk mainline unless you impose some pretty funky data checking and security on the way in.
Hope this helps.
Kind Regards
S