Which of the following attacks exploits web age vulnerabilities that allow an attacker to force an unsuspecting user's browser to send malicious requests they did not intend?

Command Injection attacks target server-side input fields to execute operating system commands on the server itself and do not involve forging requests through a victim's browser.

File Injection attacks involve inserting or including malicious files into a web application's file handling routines and are not concerned with forcing a browser to send unintended requests.

CSRF attacks work by embedding a malicious request (e.g., in an image tag or hidden form) on an attacker-controlled page. When an authenticated victim visits that page, their browser automatically includes session cookies, causing the target web application to execute the forged request as if it were legitimate. The vulnerability lies in the application trusting requests that originate from the victim's authenticated session without verifying intent.

Hidden Field Manipulation involves tampering with hidden HTML form values to alter submitted data, which requires the attacker to directly modify a request rather than tricking a victim's browser into sending one.