Multisite is an option built into every WordPress installation.
It allows multiple websites to be hosted from one installation, as a "network"
A network of separate blogs/sites
A single site with different user permissions
from section to section
<?php /* inside wp-config.php */ define('WP_ALLOW_MULTISITE', true);
e.g. site1.mynetwork.com, site2.mynetwork.com
Can also be used for full domains since WP 4.5 (or with a plugin on older versions)
e.g. mysite.com/site1, mysite.com/site2
Great for the permission segmentation strategy
Site administrators can do all of the things that an administrator of a regular WordPress installation, except:
Optionally, registration can be enabled, allowing anybody to sign up and create a site
Be very, very, very, very careful with this if you don't want to end up hosting thousands of websites selling fake watches
Stores information about the primary site
Stores the list of sites ("blogs") and their URLs
Stores metadata about the network as a whole
This creates a few vectors for attack...
Just like any other WordPress site: get the wp-content folder onto the server somehow (excepting the uploads folder)