You can add location information to your Tweets, such as your city or precise location, from the web and via third-party applications. You always have the option to delete your Tweet location history. Learn more
The "ping http://evil.com " is there because if it were "ping 1.2.3.4" it would actually work as a proper ping command, and passing vaguely-sanitized user data after a ping command to cmd /c would be a common use case.
so cmd /c "ping google.com" pings google, and cmd /c "ping google.com/../../../../windows/calc.exe" pops calc.
So the reason this is a vulnerability, not just a bug, would be if they're running a script that uses cmd /c "some string built from your user input", if your user input can contain \..\ you can pop calc (or some other exploitable exe)?
Yes, even if the string is otherwise also a valid command that would perform some other function.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
