Which is the description of CSRF (Cross Site Request Forgery)?

CSRF is a security vulnerability where an attacker tricks an authenticated user into performing unintended actions on a website by forging requests that appear to come from the user. The attack exploits the trust relationship between a user's browser and a target website. The provided options in the original question contained OCR errors and grammatical corruption that made them inaccurate, so plausible standard distractors were generated to reflect common security misconceptions.

Step-by-step Derivation:
CSRF (Cross-Site Request Forgery) fundamentally works by: (1) User logs into their bank or email, establishing an authenticated session. (2) Without logging out, the user visits a malicious site controlled by attacker. (3) The malicious site contains a hidden request (image tag, form, AJAX) that targets the user's bank (e.g., transfer money). (4) Since the user's browser still has valid cookies for the bank, the request is authenticated and executed. The key insight is that it exploits the automatic inclusion of credentials (cookies) by the browser—not injection of malicious data or script execution on the target site itself. Options A, C, and D describe other vulnerabilities (SQL injection, XSS, or direct code injection) rather than CSRF.