Which is the description of CSRF (Cross-Site Request Forgery)?

CSRF exploits the trust a user's browser has in a website by tricking the browser into making unintended requests on behalf of the user without their knowledge. Option D correctly describes this: a malicious script embedded in a webpage executes in the visitor's browser and performs unintended operations. Options A, B, and C describe different attack types (DDoS/worm, XSS injection, and SQL injection respectively), not CSRF.

Step-by-step Derivation:
CSRF (Cross-Site Request Forgery) fundamentally works by: 1) User logs into a legitimate site (e.g., bank.com), 2) User visits a malicious site without logging out, 3) Malicious site contains a hidden request to bank.com (e.g., transfer money), 4) User's browser automatically includes the authentication cookies, 5) The unintended operation executes. Option D captures this mechanism of 'running unintended operations' via embedded scripts. Option B describes XSS (Cross-Site Scripting). Option C describes SQL Injection. Option A describes a DDoS or self-propagating worm, not CSRF.