As The Straight Dope's article says, "...this is one of those stories you want desperately not to believe." Unfortunately, it seems to be true.
From Damn Interesting:
There are many troubling stories regarding human run-ins with the candirú, though until recent years these were not given much credence by the medical community. It is not uncommon for people swimming or bathing in the river to urinate in the water, an action which creates tiny water currents that are rich in urea and ammonia. It seems that the tiny, slender catfish cannot always distinguish a urinating human from an exhaling fish gill, and on occasion it will attempt its trademark high-speed attack on some unfortunate soul.
Silvio Barbossa was one such soul. He was swimming in the Amazon River when he went head to head with the tiny parasite:
"I felt like urinating. I stood up, and it was then it attacked me. The candirú attacked me. […] When I saw it, I was terrified. I grabbed it quickly so it couldn't go deeper inside. I could only see the end of its tail flapping. I tried to grab it, but it slipped away from me and went in. […] I was very afraid, because the candirú bites."
When the candirú successfully invades a human, it proceeds exactly as it would with a fish host. After entering the misidentified orifice, it quickly wriggles its way in as far as possible, often accompanied by the victim's frantic attempts to grip the slippery, mucus-coated tail. In the unlikely event that the panicked victim manages to grasp the fish, its backwards-pointing barbs would cause excruciating pain at each pull, and bring a quick end to the dramatic tug-of-war. Once inside, the parasite inches its way up the urethra to the nearest blood-gorged membrane, extends its spines into the surrounding tissue, and starts feasting.