Which of the following attacks exploits web age vulnerabilities that allow an attacker to force an unsuspecting user's browser to send malicious requests they did not intend?

Command injection attacks insert operating system commands into vulnerable input fields to execute them on the server, which does not involve forging requests from a victim's browser.

File injection attacks exploit insecure file inclusion or upload functionality to execute malicious files server-side, not to forge browser-based requests from victims.

CSRF exploits the trust a web application places in a user's browser by crafting a malicious request (such as a forged form submission or image tag) that the victim's browser sends along with valid session credentials. Because the browser automatically attaches cookies, the server cannot distinguish the forged request from a legitimate one, allowing attackers to perform unauthorized state-changing actions such as fund transfers or password changes on behalf of the victim.

Hidden field manipulation involves an attacker directly modifying hidden HTML form values before submission, which is a client-side tampering attack and does not force an unsuspecting third-party user's browser to send requests.