Witnesses said people were thrown through the air after being hit by the vehicle, which did not appear to be trying to slow down as it "mowed everybody down".
Victoria state police said they had arrested the driver of the car after it "collided with a number of pedestrians" in downtown Melbourne at a busy intersection just after 4.30pm local time (0530 GMT).
A second man was also arrested by police, who have not yet said whether they believe the driver was acting deliberately.
Paramedics were "treating and transporting to hospital" 13 people, with some seriously hurt, ambulance officials said.
Sky News Australia reported that a pre-school child with a head injury was taken to hospital in a serious condition.
Citing witnesses, Sky said a white Suzuki Grand Vitara with two men inside drove into the crowd, with no signs the vehicle made an effort to slow down.
In a tweet, police appealed to members of the public to upload any images they might have of the incident to a cloud address to help assist with their investigation.
A witness, named only as Sue, told Melbourne radio station 3AW that she heard screams and saw "people flying everywhere".
"We could hear this noise, as we looked left, we saw this white car, it just mowed everybody down," she said.
"People are flying everywhere. We heard thump, thump. People are running everywhere."
Another witness, John, told ABC Radio Melbourne that he saw a "SUV coming at high speed".
"(I) really just heard the collision with people with bags and what must be shopping trolleys - and I hope not prams," he said.
"I’ve really never seen anything like this before and I haven’t stopped shaking."
The incident came months after a car mowed down pedestrians in Melbourne’s busiest mall in January, killing six people.
The driver, whose case is still being heard in court, had been pursued by police prior to the rampage after he had allegedly stabbed his brother.
The Australian government in August unveiled a strategy aimed at preventing vehicle terror attacks carried out in crowded public places after deadly assaults in Barcelona, Nice and London.
The strategy, commissioned after 86 people were killed in the Nice truck attack last year, offered businesses and local governments a guide to assessing how vulnerable their sites are.
Suggested steps include deterrent options like fencing and closed circuit cameras, and delaying approaches such as trees and bollards to slow down vehicles. VNS