You can add location information to your Tweets, such as your city or precise location, from the web and via third-party applications. You always have the option to delete your Tweet location history. Learn more
So is the "ping http://evil,com" part there just to give it "something" before the \..\ or is it actually doing something?
The "ping http://evil.com " is there because if it were "ping 1.2.3.4" it would actually work as a proper ping command, and passing vaguely-sanitized user data after a ping command to cmd /c would be a common use case.
so cmd /c "ping google.com" pings google, and cmd /c "ping google.com/../../../../windows/calc.exe" pops calc.
So the reason this is a vulnerability, not just a bug, would be if they're running a script that uses cmd /c "some string built from your user input", if your user input can contain \..\ you can pop calc (or some other exploitable exe)?
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
